[IPsec] Comment on draft-ietf-ipsecme-ikev2-resumption-00

Hi,

I just went through the updated WG draft and RFC5077 as well.

In the draft, the new IKE_SESSION_RESUME is defined to present ticket
from client gateway for session resumption.
However, this need to modify IKEv2 base protocol by new messages and
related protection of them. From the implementation point of view, we
do not think this modification is small.
And, when we consider the case that the session resumption can not be
continued by the gateway,  gateway will reject this message. Then, the
regular IKEv2 procedure will be done afterwards. In this case, at
least one round trip is wasted.

Also, I checked RFC 5077 as a reference indicated in the charter. It
just added a SessionTicket extension to the ClientHello message for
ticket presenting from client during session resumption.

Solution:
Add a payload in the IKE INIT message for client to present the index
of ticket to GW. Then if GW can not do the session resumption for some
reason, it just sends the IKE INIT response to clients and starts the
regular IKEv2 initiation procedure. IMHO, this way is more efficient
and flexible.

Peny
_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec