Subject: Re: [IPsec] AD review of draft-ietf-ipsecme-rfc4307bis

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 6 Jan 2017 15:51:10 -0500

Hello,

I never got an answer as to whether or not I should wait on the last call,
so I pushed it through.  No comments came in during the holiday period.
Should last call be extended?  Or does the WG feel the reason was because
the document is ready?  If the latter then I'll get it ready for an IESG
telechat.  I'd prefer to put it on 2/2/2017 as there are already a fair
number of documents on the telechat in 2 weeks.

Thanks,
Kathleen

On Fri, Dec 16, 2016 at 3:44 PM, Kathleen Moriarty <
[email-masked]> wrote:

> Hi Paul,
>
> Thanks for your response and sorry for my delayed response.
>
> On Mon, Dec 12, 2016 at 1:10 PM, Paul Wouters <[email-masked]> wrote:
>
>> On Fri, 9 Dec 2016, Kathleen Moriarty wrote:
>>
>> Hello,
>>> Thanks for your work on draft-ietf-ipsecme-rfc4307bis.  I reviewed the
>>> draft and just have a few questions, the first is a nit.
>>>
>>>
>>> Nit:
>>> In the second paragraph of 1.3, you can drop the last two words of this
>>> sentence as they are redundant:
>>>
>>>    This document does not give any recommendations for the use of
>>>    algorithms, it only gives implementation recommendations for
>>>    implementations.
>>>
>>
>> Will do if we do a new draft version, or else will remind RFC editor of
>> it.
>
>
> Great.
>
>>
>>
>> In section 3.2 & 3.3, why isn't there a bigger jump down to SHOULD or
>>> SHOULD- for:
>>>
>>> PRF_HMAC_SHA1     | MUST-    |
>>>
>>> | AUTH_HMAC_SHA1_96      | MUST- The justifications seems like a bigger
>>> jump would be appropriate.
>>>
>>
>> In 4307 itself, we only had one MUST and that was SHA1. The SHOULD+
>> candidate was AES_XCBC but it was been overtaken in reality by SHA2.
>> And AESPRF/AES_MAC is not as widely implemented (example: not
>> available in NSS) so even those implementors who picked the MUST
>> and SHOULD algorithm only have SHA1 and AESPRF/AES_MAC. If a 4307bis
>> implementation only implements the MUST algorithms, it would not interop
>> with a 4307 implementation that implemented all the MUST and SHOULDs,
>> if we made SHA1 a SHOULD- or less.
>>
>> I think the available options we have are MUST- or SHOULD-. I think
>> MAY or SHOULD NOT would lead to interoperability issues. I think the
>> MUST- is still the best choice.
>>
>> Note also that all SHA1 use here is still safe (HMAC and PRF are
>> different from plain SHA1)
>>
>> Note though that I would like to keep the status for Type 2 and Type 3
>> the same, because all sane implementations will use the same INTEG and
>> PRF algorithms for a given IKE session, so these two are tightly
>> coupled.
>
>
> Yeah, I knew it was fine, but the justification provided was enough to
> drop it further, so I wanted to poke at that a bit as it'll take the next
> update to drop it further.  If that's what the WG agreed to, that's fine.
> I'll push this through to IETF last call unless the WG wants me to wait
> until after the holidays.
>
> Thank you,
> Kathleen
>
>>
>>
>> Paul
>>
>
>
>
> --
>
> Best regards,
> Kathleen
>

-- 

Best regards,
Kathleen

---

From: Paul Wouters <[email-masked]>
Date: Fri, 6 Jan 2017 15:56:30 -0500 (EST)

On Fri, 6 Jan 2017, Kathleen Moriarty wrote:

> I never got an answer as to whether or not I should wait on the last call, so I pushed it through.  No comments
> came in during the holiday period.  Should last call be extended?  Or does the WG feel the reason was because the
> document is ready?  If the latter then I'll get it ready for an IESG telechat.  I'd prefer to put it on 2/2/2017
> as there are already a fair number of documents on the telechat in 2 weeks.

If you schedule it for 2/2 then I guess we can give people another two
weeks for comments? Although I'm not sure if that means we will get
more comments :)

Paul

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 6 Jan 2017 16:01:09 -0500

On Fri, Jan 6, 2017 at 3:56 PM, Paul Wouters <[email-masked]> wrote:

>> so I pushed it through.  No comments
>> came in during the holiday period.  Should last call be extended?  Or
>> does the WG feel the reason was because the
>> document is ready?  If the latter then I'll get it ready for an IESG
>> telechat.  I'd prefer to put it on 2/2/2017

I'm not sure we'll get more either.  Is 2/2 okay or is there any rush for
this draft?

Thanks!

-- 

Best regards,
Kathleen

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Mon, 9 Jan 2017 14:31:50 +0000

Kathleen,

I am just getting back after taking a long holiday. Sorry I was AFK on this one.

We want to advance rfc7321bis to go through the remainder of IESG review with 4307bis as a pair. Unfortunately, I wasn’t able to get this done before leaving on holiday. I need to do a WGLC on rfc7321bis starting ASAP this week. Can you hold 4307bis for a bit to have the two run concurrently?

Thanks,
Dave

From: IPsec [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Friday, January 06, 2017 4:01 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [IPsec] AD review of draft-ietf-ipsecme-rfc4307bis

On Fri, Jan 6, 2017 at 3:56 PM, Paul Wouters <[email-masked]<mailto:[email-masked]>> wrote:

If you schedule it for 2/2 then I guess we can give people another two
weeks for comments? Although I'm not sure if that means we will get
more comments :)
I'm not sure we'll get more either.  Is 2/2 okay or is there any rush for this draft?

Thanks!

Paul

--

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 9 Jan 2017 09:43:23 -0500

Hi Dave,

Yes, I can remove the telechat date and reset it when the WG os ready.
With that, it seems it would be fine to add time to the IETF last call
(restart).

Thank you,
Kathleen

On Mon, Jan 9, 2017 at 9:31 AM, Waltermire, David A. (Fed) <
[email-masked]> wrote:

> We want to advance rfc7321bis to go through the remainder of IESG review
> with 4307bis as a pair. Unfortunately, I wasn’t able to get this done
> before leaving on holiday. I need to do a WGLC on rfc7321bis starting ASAP
> this week. Can you hold 4307bis for a bit to have the two run concurrently?
>
>
>
> Thanks,
>
> Dave
>
>
>
> *From:* IPsec [mailto:[email-masked]] *On Behalf Of *Kathleen
> Moriarty
> *Sent:* Friday, January 06, 2017 4:01 PM
> *To:* [email-masked]
> *Cc:* [email-masked]
> *Subject:* Re: [IPsec] AD review of draft-ietf-ipsecme-rfc4307bis
>
>
>
>
>
>
>

-- 

Best regards,
Kathleen

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Mon, 9 Jan 2017 15:23:55 +0000

Kathleen,

Thanks. Happy new year!

Regards,
Dave

From: Kathleen Moriarty [mailto:[email-masked]]
Sent: Monday, January 09, 2017 9:43 AM
To: Waltermire, David A. (Fed) <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [IPsec] AD review of draft-ietf-ipsecme-rfc4307bis

Hi Dave,

Yes, I can remove the telechat date and reset it when the WG os ready.  With that, it seems it would be fine to add time to the IETF last call (restart).

Thank you,
Kathleen

On Mon, Jan 9, 2017 at 9:31 AM, Waltermire, David A. (Fed) <[email-masked]<mailto:[email-masked]>> wrote:
Kathleen,

Thanks,
Dave

From: IPsec [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Kathleen Moriarty
Sent: Friday, January 06, 2017 4:01 PM
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [IPsec] AD review of draft-ietf-ipsecme-rfc4307bis

Thanks!

Paul

--

Best regards,
Kathleen

--

Best regards,
Kathleen