Subject: [IPsec] Last Call: <draft-kivinen-ipsecme-ikev2-rfc5996bis-02.txt> (Internet Key Exchange Protocol Version 2 (IKEv2)) to Internet Standard

From: The IESG <[email-masked]>
Date: Fri, 04 Apr 2014 13:27:50 -0700

The IESG has received a request from the IP Security Maintenance and
Extensions WG (ipsecme) to consider the following document:
- 'Internet Key Exchange Protocol Version 2 (IKEv2)'
  <draft-kivinen-ipsecme-ikev2-rfc5996bis-02.txt> as Internet Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2014-04-18. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   This document describes version 2 of the Internet Key Exchange (IKE)
   protocol.  IKE is a component of IPsec used for performing mutual
   authentication and establishing and maintaining Security Associations
   (SAs).  This document replaces and updates RFC 5996, and includes all
   of the errata for it, and it is intended to update IKEv2 to be
   Internet Standard.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-kivinen-ipsecme-ikev2-rfc5996bis/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-kivinen-ipsecme-ikev2-rfc5996bis/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: "PUTMAN, Tony (Tony)" <[email-masked]>
Date: Thu, 17 Apr 2014 17:23:15 +0000

All,

In section 3.6 (top of page 94), there is the statement,
  "If multiple certificates
   are sent, the first certificate MUST contain the public key used to
   sign the AUTH payload."

"sign" should be "validate".

Regards,
Tony
--
Tony Putman
Alcatel-Lucent Technologies

-----Original Message-----
From: IPsec [mailto:[email-masked]] On Behalf Of The IESG
Sent: Friday, April 04, 2014 9:28 PM
To: IETF-Announce
Cc: [email-masked]
Subject: [IPsec] Last Call: <draft-kivinen-ipsecme-ikev2-rfc5996bis-02.txt> (Internet Key Exchange Protocol Version 2 (IKEv2)) to Internet Standard

Abstract

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 17 Apr 2014 20:42:23 +0300

Hi, Tony

Thanks for the review.

I assume you mean that you don’t sign with public keys. Replacing “sign” with “validate” makes for a strange sentence, because the sentence is about sending (and presumably signing) rather than receiving (and validating).

How about:
“If multiple certificate are sent, the first MUST contain the public key associated with the private key used to sign the AUTH payload”

Yoav

---

From: "PUTMAN, Tony (Tony)" <[email-masked]>
Date: Tue, 22 Apr 2014 09:56:46 +0000

Hi Yoav,

Yes, that's what I meant; your suggestion is fine with me.  To be honest, I wasn't sure whether this was a "substantive comment" or not, but the question was raised to me by a colleague and I thought that I should pass it on.  Apologies if my comment was too brief (and for the late follow-up).

Tony

-----Original Message-----
From: Yoav Nir [mailto:[email-masked]]
Sent: Thursday, April 17, 2014 6:42 PM
To: PUTMAN, Tony (Tony)
Cc: [email-masked]; [email-masked]
Subject: Re: [IPsec] Last Call: <draft-kivinen-ipsecme-ikev2-rfc5996bis-02.txt> (Internet Key Exchange Protocol Version 2 (IKEv2)) to Internet Standard

Hi, Tony

Thanks for the review.

How about:

Yoav

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 25 Apr 2014 15:37:50 +0300

Yoav Nir writes:
> I assume you mean that you don’t sign with public keys. Replacing
> “sign” with “validate” makes for a strange sentence, because the
> sentence is about sending (and presumably signing) rather than
> receiving (and validating). 
> 
> How about:
> “If multiple certificate are sent, the first MUST contain the public
> key associated with the private key used to sign the AUTH payload” 

Changed text to :

If multiple certificates are sent, the first certificate MUST contain
the public key associated with the private key used to sign the AUTH
payload.

-- 
[email-masked]