Subject: [IPsec] WG Last Call on draft-ietf-ipsecme-oob-pubkey

From: Paul Hoffman <[email-masked]>
Date: Mon, 8 Apr 2013 14:43:47 -0700

Greetings again. This begins the WG Last Call on draft-ietf-ipsecme-oob-pubkey, "More Raw Public Keys for IKEv2". You can find the current draft at http://tools.ietf.org/html/draft-ietf-ipsecme-oob-pubkey

This document generated a fair amount of interest early, but we have not had much discussion since. Yaron and I would *really* like to have at least five WG members review the document and say on the list whether or not they think it is ready in its current state to move to IETF review. If you read it and feel it is not ready for any reason, please also say that in your message to the list.

Again, participating in WG Last Calls is a great opportunity for those who are less active in the WG but who want to contribute to the IETF to make a difference.

The WG Last Call should end in two weeks, on April 22. Please review the document before then. Thanks in advance!

--Paul Hoffman

---

From: Michael Richardson <[email-masked]>
Date: Mon, 08 Apr 2013 22:47:55 -0400

>>>>> "Paul" == Paul Hoffman <[email-masked]> writes:
    Paul> http://tools.ietf.org/html/draft-ietf-ipsecme-oob-pubkey 

I have read this document anew.

I found the jump in section 3 to:

   When the certificate encoding type 'Raw Public Key' is used then the
   Certificate Data only contains the SubjectPublicKeyInfo part of the
   PKIX certificate.

to be confusing on first read.  Perhaps this is because I attempt to be
as ignorant of PKCS/PKIX stuff as possible. (I admit that I'm a failure
at this).

I think that it is telling me that it's not just a raw RSA key, which is
really the whole point of this exercise, but rather just the
SubjectPublicKeyInfo part.   I think that this paragraph could be made
clearer to people who are trying to avoid knowing anything about PKIX.

I followed the reference to draft-ietf-tls-oob-pubkey-07, which I read.
I would like to suggest that section 3 more quickly refers to the
tls-oob-pubkey Appendix A, and that it say something like:

   In order to provide a simple and standard way to indicate the key
   type when the encoding type is 'Raw Public Key', the 
   SubjectPublicKeyInfo structure of the PKIX certificate is used.
   This is a a very simple encoding, as most of the ASN.1 part can be
   included literally, and recognized by block comparison.  See 
   [draft-ietf-tls-oob-pubkey] Appendix A for a detailed breakdown.
   In addition, Appendix A has a few examples.

(Yes, add a second example... an RSA example.)

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 17 Apr 2013 08:18:41 -0700

We have gotten exactly one response to this, even though there were lots of people who said they thought this was a valuable addition to IKEv2. Please comment before Monday so we don't have to abandon the work.

--Paul Hoffman

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 22 Apr 2013 10:29:01 +0300

We have still not heard any additional responses for this last call. If 
you think this draft is useful, please say so on the list. If you think 
it needs to be fixed, please send your comments.

We are extending this LC until Friday of this week.

Thanks,
	Yaron

On 2013-04-17 18:18, Paul Hoffman wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Cuiyang <[email-masked]>
Date: Tue, 23 Apr 2013 12:18:55 +0000

Support this draft to go on to IETF review.

I have read this draft and feel that it is useful to let IKEv2 support more types of raw public keys, such as ECC.
The certificate encoding has used a new format and obsoleted the old RSA public key format "11".
And if such an old encoding is received, it MUST NOT be considered as a fatal error.

One typo found: at the last sentence in Sec 3. "needs to followed" should be "needs to be followed".

BR Yang
==================
 Yang Cui,  Ph.D.
 Huawei Technologies
 [email-masked]

> -----邮件原件-----
> 发件人: [email-masked] [mailto:[email-masked]] 代表 Yaron
> Sheffer
> 发送时间: 2013年4月22日 15:29
> 收件人: Paul Hoffman; IPsecme WG
> 主题: Re: [IPsec] STRONG NUDGE: WG Last Call on
> draft-ietf-ipsecme-oob-pubkey
> 
> > We have gotten exactly one response to this, even though there were lots of
> people who said they thought this was a valuable addition to IKEv2. Please
> comment before Monday so we don't have to abandon the work.
> >
> > --Paul Hoffman
> >
> >> Greetings again. This begins the WG Last Call on
> draft-ietf-ipsecme-oob-pubkey, "More Raw Public Keys for IKEv2". You can find
> the current draft at http://tools.ietf.org/html/draft-ietf-ipsecme-oob-pubkey
> >>
> >> This document generated a fair amount of interest early, but we have not
> had much discussion since. Yaron and I would *really* like to have at least five
> WG members review the document and say on the list whether or not they
> think it is ready in its current state to move to IETF review. If you read it and
> feel it is not ready for any reason, please also say that in your message to the
> list.
> >>
> >> Again, participating in WG Last Calls is a great opportunity for those who
> are less active in the WG but who want to contribute to the IETF to make a
> difference.
> >>

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 25 Apr 2013 15:21:08 +0300

> should be "needs to be followed". 

Fixed now in my local version. 
-- 
[email-masked]

---

From: "PUTMAN, Tony (Tony)" <[email-masked]>
Date: Thu, 25 Apr 2013 17:46:00 +0000

I would like to express support for this draft.  I have reviewed the draft and have no comments on the contents.

I am a user of IPsec, not an implementer.  I feel that this will make support for raw keys more attractive to implementors so that it will become more widely available.  Raw public keys in conjunction with DANE is likely to be useful as a lighter-weight alternative to full PKI.

Regards,
Tony
--
Tony Putman
Alcatel-Lucent

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Yaron Sheffer
Sent: 22 April 2013 08:29
To: Paul Hoffman; IPsecme WG
Subject: Re: [IPsec] STRONG NUDGE: WG Last Call on draft-ietf-ipsecme-oob-pubkey

Thanks,
        Yaron