Subject: [IPsec] Charter update

From: Yaron Sheffer <[email-masked]>
Date: Sat, 19 Jul 2014 19:48:12 +0300

IPsec folks,

Our existing charter (http://tools.ietf.org/wg/ipsecme/charters) is
badly out of date. Below is a proposed charter revision. Please
review and comment on the list. We might also discuss the new
charter in the face-to-face next week.

Thanks,

Paul and Yaron

IP Security Maintenance and Extensions (ipsecme)

------------------------------------------------

Charter

Current Status: Active

Chairs:

Paul E. Hoffman <[email-masked]>

Yaron Sheffer <[email-masked]>

Security Area Directors:

Stephen Farrell <[email-masked]>

Kathleen Moriarty <[email-masked]>

Security Area Advisor:

Kathleen Moriarty <[email-masked]>

Mailing Lists:

General Discussion: [email-masked]

To Subscribe:       https://www.ietf.org/mailman/listinfo/ipsec

Archive:            http://www.ietf.org/mail-archive/web/ipsec/

Description of Working Group:

The IPsec suite of protocols includes IKEv1 (RFC 2409

and associated RFCs), IKEv2 (RFC 5996), and the IPsec

security architecture (RFC 4301). IPsec is widely

deployed in VPN gateways, VPN remote access clients,

and as a substrate for host-to-host, host-to-network,

and network-to-network security.

The IPsec Maintenance and Extensions Working Group

continues the work of the earlier IPsec Working Group

which was concluded in 2005. Its purpose is to maintain

the IPsec standard and to facilitate discussion of

clarifications, improvements, and extensions to IPsec,

mostly to IKEv2. The working group also serves as a

focus point for other IETF Working Groups who use IPsec

in their own protocols.

The current work items include:

Recently discovered incorrect behavior of ISPs poses a

challenge to IKE, whose UDP messages (especially #3 and #4)

sometimes get fragmented at the IP level and then dropped

by these ISPs. There is interest in solving this issue by

allowing transport of IKE over TCP; this is currently

implemented by some vendors. The group will standardize such

a solution.

The WG will review and revise the list of mandatory-to-

implement algorithms for ESP and AH based on five years of
experience

with newer algorithms and cryptographic modes.

The WG will revise the IKEv2 specification with a small number

of mandatory tests required for the secure operation of IKEv2

when using elliptic curve cryptography. This work will be based

on draft-sheffer-ipsecme-dh-checks.

IKEv2 has had many interoperable implementations and can now be
considered

a mature protocol. The WG will republish the protocol as an
Internet Standard.

At the time of writing, all the above are in late stages of the
IETF process.

Therefore, the WG will go into low-power mode: it will remain
active as a focal point

for the IPsec community. But it will only take on new work items
if a strong community

interest can be seen.

This charter will expire in July 2015 (12 months from approval).

If the charter is not updated before that time, the WG will be

closed and any remaining documents revert back to individual

Internet-Drafts.

Goals and Milestones:

Done - IETF Last Call on large scale VPN use cases and
requirements

Done - IETF last call on IKE fragmentation solution

Done - IETF last call on new mandatory-to-implement algorithms

[No current milestones]

---

From: Paul Wouters <[email-masked]>
Date: Sat, 19 Jul 2014 15:51:00 -0400 (EDT)

>    implemented by some vendors. The group will standardize such

The working group had already reached consensus not to support two
different fragmentation solutions and to only support 
draft-smyslov-ipsecme-ikev2-fragmentation, after Yoav's IKE TCP
presentation, I believe in London? So I don't think this item belongs
on the agenda, unless we are looking at revising that earlier decision.

> Goals and Milestones:
> 
>   Done - IETF Last Call on large scale VPN use cases and requirements

Could we add something about assisting  Opportunistic Encryption, or
whatever term will be used? There is the auth_none draft, and there
will be an OE draft by the libreswan team soon. Those will end up in
ipsecme.

Paul

---

From: Yaron Sheffer <[email-masked]>
Date: Sat, 19 Jul 2014 22:58:14 +0300

> on the agenda, unless we are looking at revising that earlier decision.

We have a fragmentation draft (almost) past IESG review. So we're not 
revising any decision. "The group will standardize such a solution" is 
still correct, until we actually publish the document.

> will be an OE draft by the libreswan team soon. Those will end up in

Quoting the new text, the group "will only take on new work items if a 
strong community interest can be seen." Do we have other people 
supporting such an addition to the charter?

---

From: Paul Wouters <[email-masked]>
Date: Sat, 19 Jul 2014 16:10:40 -0400 (EDT)

On Sat, 19 Jul 2014, Yaron Sheffer wrote:

> revising any decision. "The group will standardize such a solution" is still 
> correct, until we actually publish the document.

You are revising the decision NOT to have IKE TCP:

 	"There is interest in solving this issue by
 	 allowing transport of IKE over TCP; this is currently
 	 implemented by some vendors. The group will standardize such
 	 a solution."

If you remove the first sentence, then it only talks about UDP and how
we are working on standarising fragmentation support using UDP.

Paul

---

From: Yaron Sheffer <[email-masked]>
Date: Sat, 19 Jul 2014 23:19:33 +0300

> we are working on standarising fragmentation support using UDP.

OK, makes sense. We need to remove that sentence.

Thanks,
	Yaron

---

From: Daniel Migault <[email-masked]>
Date: Mon, 21 Jul 2014 20:31:52 +0200

Hi,

If that is appropriated I would like to see the following items on the
charter:
    - 1) multiple interfaces that is describing how to optimize the IPsec
settings between two hosts when at least one of the host has more than one
interface.
    - 2) beet mode that defining a new mode so the overhead of IPsec
Payload can be reduced,
    - 3) IPsec contexts that is documenting the parameters that are
exchanged between two Security Gateways in order to manage clusters of VPN
Security Gateways.
    - 4) Extending MOBIKE to transport mode.
    - 5) Finally, I think there might be some work in order to enable IPsec
for IoT, especially designing IKEv2 extensions or looking at defining a
mode or a way to send ESP payload without carrying the IV.

BR,
Daniel

On Sat, Jul 19, 2014 at 10:19 PM, Yaron Sheffer <[email-masked]>
wrote:

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 26 Jul 2014 09:57:57 -0700

[[ Another nudge to keep this thread going. If you care about the charter, please comment. ]]

On Jul 19, 2014, at 9:48 AM, Yaron Sheffer <[email-masked]> wrote:

> IPsec folks,
> 
> Our existing charter (http://tools.ietf.org/wg/ipsecme/charters) is badly out of date. Below is a proposed charter revision. Please review and comment on the list. We might also discuss the new charter in the face-to-face next week.
> 
> Thanks,
>     Paul and Yaron
> 
> 
>    implement algorithms for ESP and AH based on five years of experience 
>    IKEv2 has had many interoperable implementations and can now be considered
>    a mature protocol. The WG will republish the protocol as an Internet Standard.
> 
>    At the time of writing, all the above are in late stages of the IETF process.
>    Therefore, the WG will go into low-power mode: it will remain active as a focal point
>    for the IPsec community. But it will only take on new work items if a strong community
>    interest can be seen.
>

---

From: Sean Turner <[email-masked]>
Date: Mon, 28 Jul 2014 11:16:22 -0400

> Our existing charter (http://tools.ietf.org/wg/ipsecme/charters) is badly out of date. Below is a proposed charter revision. Please review and comment on the list. We might also discuss the new cha…

I don’t think a revised charter is needed to strike the references to ADVPN as well as extend the window to adopt new wg items by six more months.  There’s an existing time-out in the charter (January 2015) and if nothing is adopted by the existing time-out I think the WG should close - assuming of course all of the existing drafts have been published as RFCs.  

Obviously, If the wg is closed the mailing list should remain open to provide a place for the community to discuss ipsec-related issues and a place for ADs to ask about AD-sponsored drafts.

If a re-charter does proceed, two things:

1)   I can see extending the time-out if you’re adding new work items during this recharter not if you’re removing references to work items.  I’d suggest that January 2015 remain as the time-out date.

2) I’d tweak the following a bit to lead more with the current state of affairs:

>    closed and any remaining documents revert back to individual

NEW:

The WG has progressed the following documents to the IESG for publication and will remain open until these drafts are published as RFCs or this charter is revised to add new work items:

  draft-ietf-ipsecme-esp-ah-reqts: Revises the list of
  mandatory-to-implement algorithms for ESP and AH
  based on five years of experience with newer
  algorithms and cryptographic modes.

  draft-ietf-ipsecme-ikev2-fragmentation: Performs
  fragmentation of large messages by IKEv2 itself,
  replacing them by series of smaller messages.

  draft-kivinen-ipsecme-ikev2-rfc5996bis: Republishes
  the protocol as an Internet Standard because the
  protocol is now a mature protocol.

  draft-kivinen-ipsecme-signature-auth: Revises the
  IKEv2 specification with a small number of mandatory
  tests required for the secure operation of IKEv2 when
  using elliptic curve cryptography.

This charter expires in January 2015.  If the charter is not updated before that time to add new WG items, the WG will be closed.  New work items will be adopted only if there if there is strong community support can be demonstrated.  In the event of closure, the WG will request that the mailing remain open to act a focal point for the IPsec community.

spt

---

From: Michael Richardson <[email-masked]>
Date: Mon, 28 Jul 2014 13:20:12 -0400

Paul Hoffman <[email-masked]> wrote:
    >> Recently discovered incorrect behavior of ISPs poses a challenge to
    >> IKE, whose UDP messages (especially #3 and #4) sometimes get
    >> fragmented at the IP level and then dropped by these ISPs. There is
    >> interest in solving this issue by allowing transport of IKE over TCP;
    >> this is currently implemented by some vendors. The group will
    >> standardize such a solution.

I think that we gave up over TCP, and have back to fragmentation inside IKE,
right?

    >> The WG will revise the IKEv2 specification with a small number of
    >> mandatory tests required for the secure operation of IKEv2 when using
    >> elliptic curve cryptography. This work will be based on
    >> draft-sheffer-ipsecme-dh-checks.

I think we already completed this?

    >> Done - IETF last call on IKE fragmentation solution Done - IETF last
    >> call on new mandatory-to-implement algorithms

Seems like we should have more milestones listed.

I'd like to make the puzzle solving work charter.
I imagine that this is a real problem, but I wouldn't mind some data on how
often gateways are being DDoSed.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-