[Ipsec] Comments of draft-eronen-ipsec-ikev2-clarifications-02.txt

Tero Kivinen writes:
> Also if we think more about the IKE SA rekeying, I do not think there
> is any reason to do that unless you also do new Diffie-Hellman there
> too. Rekeying IKE SA because of the IKE message ID wrapping is not
> common. The current IKEv2 text is not clear wheather the intension was
> that IKE SA rekey MUST have KE payloads, but I think we should mandate
> them, i.e. say in the NEW-1.3.2 that KE payloads are not optional
> there.

Actually it is clear from the draft-ietf-ipsec-ikev2-17.txt that
Diffie-Hellman parameter is NOT optional when rekeying IKE. The 3.3.3
lists D-H as mandatory type if the protocol is IKE, and the 3.3.2 does
the same in the Transform Type Values table. So KE payloads are not
optional in the NEW-1.3.2.

-----------------------------------------------------------------------
3.3.2 Transform Substructure
...
   Transform Type Values
...
          Diffie-Hellman Group (D-H)      4  (IKE, optional in AH & ESP)
...
3.3.3 Valid Transform Types by Protocol
...
          Protocol  Mandatory Types        Optional Types
            IKE     ENCR, PRF, INTEG, D-H
...
-- 
kivinen@safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec