Re: [IPsec] Closing the IKEv2bis open issues

[Yoav Nir <ynir at checkpoint.com>]

A few lines above this section it already says "If the responder's  
policy allows it to accept the first selector of TSi and TSr, then the  
responder MUST narrow the traffic selectors to a subset that includes  
the initiator's first choices."

So there is a MUST requirement to select the initiator's first choice  
(if possible), so I don't think the SHOULD and MAY are appropriate  
here. The way I read this section, it only clarifies what to do if the  
initiator traffic selector (first or not) is too broad. In that case,  
we shouldn't mention the initiator's choices.

On Oct 20, 2009, at 6:19 PM, Paul Hoffman wrote:

> Issue #25, Choice of the right TS when narrowing
<snip/>
> Proposed change:
>   When narrowing is done, there may be several subsets that are
>   acceptable but their union is not.  In this case, the responder
>   SHOULD select the initiator's first choice (to be interoperable
>   with RFC 4306), but MAY arbitrarily select any of them,
>   and MAY include an
>   ADDITIONAL_TS_POSSIBLE notification in the response.

Attachment: smime.p7s
Description: S/MIME cryptographic signature