Subject: [IPsec] RFC5996bis section 3.1 comment

From: Tero Kivinen <[email-masked]>
Date: Fri, 25 Apr 2014 15:43:27 +0300

I am making new version of the rfc5996bis, so going through old emails
too... 

Paul Wouters writes:
> On Thu, 17 Oct 2013, Tero Kivinen wrote:
> 
> [forgive me if already reported]
> 
> Section 3.1 states:
> 
>     o  Major Version (4 bits) - Indicates the major version of the IKE
>        protocol in use.  Implementations based on this version of IKE
>        MUST set the major version to 2.  Implementations based on
>        previous versions of IKE and ISAKMP MUST set the major version to
> -->   1.  Implementations based on this version of IKE MUST reject or
>        ignore messages containing a version number greater than 2 with an
>        INVALID_MAJOR_VERSION notification message as described in Section
>        2.5.
> 
> The reading of "this version" on the line marked "-->" is a little
> unclear. Does it refer to the previous sentence's version (version 1)
> or this version as in "this document's" version (version 2). I suggest
> replacing "this version" with "this document's version"

Changed to:

Major Version (4 bits) - Indicates the major version of the IKE
protocol in use. Implementations based on this version of IKE MUST set
the major version to 2. Implementations based on previous versions of
IKE and ISAKMP MUST set the major version to 1. Implementations based
on this document's version (version 2) of IKE MUST reject or ignore
messages containing a version number greater than 2 with an
INVALID_MAJOR_VERSION notification message as described in Section
2.5.

>     o  Minor Version (4 bits) - Indicates the minor version of the IKE
>        protocol in use.  Implementations based on this version of IKE
>        MUST set the minor version to 0.  They MUST ignore the minor
>        version number of received messages.
> 
> For the Major we tell what IKEv1 implementations should do. Why don't we
> do that for the Minor as well? Suggested addition:
> 
>  	Implementations based on the previous major version of IKE and
>  	ISAKMP MUST set the minor version to 0 and reject or ignore
>  	messages containing a minor version number greater than 0 with
>  	an INVALID_MINOR_VERSION  notification message.

I do not think we want to specify how IKEv1 implementations needs to
work. This is IKEv2, and as IKEv2 will ignore the minor version
number, it does not matter what IKEv1 implementations do it, or how
they sent it. The Major version number text was needed as
implementations need to know how to differentiate IKEv1 and IKEv2,
minor version number handling of IKEv1 does not matter for IKEv2
implementations. 
-- 
[email-masked]