Subject: [IPsec] Benoit Claise's No Objection on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

From: Benoit Claise <[email-masked]>
Date: Thu, 16 Mar 2017 01:26:39 -0700

Benoit Claise has entered the following ballot position for
draft-ietf-ipsecme-rfc7321bis-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-rfc7321bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

As discussed based on the OPS DIR review:

Hi Paul,

To avoid any future questions, are your 3 justifications below mentioned
in the draft?

Regards, Benoit
> On 03/13/2017 07:17 AM, Sheng Jiang wrote:
>
> Hello Sheng,
>
> thanks for your review!
>
>> Comparing with RFC 7321, this document uses different names for
algorithms. Although it looks consistent, it may reduce readability a
little. The below items, I would like to double check for consistent.
>>
>>
>>
>> 3DES ?= TripleDES-CBC (old)
>>
>> DES ?= DES-CBC (old)
>>
>> AES_XCBC_96 ?= AES-XCBC-MAC-96 (old)
> e actually changed all names to match the actual IANA IKEv2 entries at
http://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml
>
>> There are a few new algorithms mentioned, without any description or
analysis. Additional explanation should be needed.
>>
>>
>> DES_IV64
>>
>> DES_IV32
>>
>> 3IDEA
> Those are old reserved entries that have no implementation and therefor
actually have no RFC we can point to. Which is also why we made
> it very clear these are MUST NOT.
>
>> I actually have more concerns regarding to the below algorithm that is
mentioned in RFC7321, but not in this document. Does it create a new
hole?
>>
>>
>> AES-CTR [RFC3686]
> It was mentioned in 7321 because it went from SHOULD to MAY.
>
> It is not mentioned in 7321bis because it is still at MAY, and we do
not list any algorithms in MAY.
>
> I hope this clarifies your questions,
>
> Paul