[IPsec] Is IKEv2 mandatory to implement?

Tero Kivinen <kivinen@iki.fi> Fri, 30 April 2010 08:48 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-ID: <19418.39211.806428.816790@fireball.kivinen.iki.fi>
Date: Fri, 30 Apr 2010 11:47:39 +0300
From: Tero Kivinen <kivinen@iki.fi>
To: Thomas Narten <narten@us.ibm.com>
In-Reply-To: <201004291853.o3TIrpe6014408@cichlid.raleigh.ibm.com>
References: <201004291853.o3TIrpe6014408@cichlid.raleigh.ibm.com>
Cc: ipsec@ietf.org
Subject: [IPsec] Is IKEv2 mandatory to implement?
Precedence: list

Thomas Narten writes:
> Is there more specific wording in 4301 on this point? Is it viewed as
> an absolute MUST requirement to implement IKEv2 in order to claim
> compliance with RFC4301?

RFC4301 says in section 4.5:
----------------------------------------------------------------------
4.5.  SA and Key Management

   All IPsec implementations MUST support both manual and automated SA
   and cryptographic key management.  ...
...

4.5.2.  Automated SA and Key Management

   Widespread deployment and use of IPsec requires an Internet-standard,
   scalable, automated, SA management protocol.  Such support is
   required to facilitate use of the anti-replay features of AH and ESP,
   and to accommodate on-demand creation of SAs, e.g., for user- and
   session-oriented keying.  (Note that the notion of "rekeying" an SA
   actually implies creation of a new SA with a new SPI, a process that
   generally implies use of an automated SA/key management protocol.)

   The default automated key management protocol selected for use with
   IPsec is IKEv2 [Kau05].  This document assumes the availability of
   certain functions from the key management protocol that are not
   supported by IKEv1.  Other automated SA management protocols MAY be
   employed.
...
----------------------------------------------------------------------

I.e. automated key management is mandatory, but the automated key
management protocol can also be something else than IKEv2, but for
example IKEv1 is NOT enough, as certain functions required by RFC4301
are missing.

I do not think there currently exists any other automated key
management protocol that could be used for RFC4301 than IKEv2. 
-- 
kivinen@iki.fi

[IPsec] Is IKEv2 mandatory to implement? Thomas Narten
[IPsec] Is IKEv2 mandatory to implement? Tero Kivinen