IETF Proceedings

IETF-96 Proceedings

Introduction | Area, Working Goup & BoF Reports | Plenaries | Training | Internet Research Task Force

IP Security Maintenance and Extensions (ipsecme) (WG)

Minutes | Jabber Logs | Mailing List Archives

Additional information is available at tools.ietf.org/wg/ipsecme

Chair(s):

Security Area Area Director(s):

Assigned Area Director

Kathleen Moriarty

Status Update (provided 2016-07-20)

The DDoS protection draft is through WGLC, and should be going forward soon. The mandatory to implement crypto algorithm drafts (rfc4307bis, rfc7321bis) got some discussion and there will be at new versions submitted before they are ready. Safecurves document is also getting ready for the WGLC, so we should have several documents going out from the WG soon.

After that we had discussion about the TCP encapsulation of the IKEv2, and then requirements for the quantum resistance in the IKEv2, both which are new work to be chartered in the WG.

We will be updating our charter to add new items (MIT algoritm updates, new algorithms, quantum resistance, TCP encapsulation, split dns, implicit IV).

Recordings:

Video recording for 2016-07-19 14:00

Meeting Slides:

Charter (as of 2016-09-02):

The IPsec suite of protocols includes IKEv1 (RFC 2409 and associated RFCs), IKEv2 (RFC 7296), and the IPsec security architecture (RFC 4301). IPsec is widely deployed in VPN gateways, VPN remote access clients, and as a substrate for host-to-host, host-to-network, and network-to-network security.

The IPsec Maintenance and Extensions Working Group continues the work of the earlier IPsec Working Group which was concluded in 2005. Its purpose is to maintain the IPsec standard and to facilitate discussion of clarifications, improvements, and extensions to IPsec, mostly to IKEv2. The working group also serves as a focus point for other IETF Working Groups who use IPsec in their own protocols.

The current work items include:

IKEv2 contains the cookie mechanism to protect against denial of service attacks. However this mechanism cannot protect an IKE end-point (typically, a large gateway) from "distributed denial of service", a coordinated attack by a large number of "bots". The working group will analyze the problem and propose a solution, by offering best practices and potentially by extending the protocol.

There is interest in adapting the IKE protocol for opportunistic use cases, by allowing one or both endpoints of the exchange to remain unauthenticated. The group will extend the protocol to support these use cases.

This charter will expire in December 2015 (a year from approval). If the charter is not updated before that time, the WG will be closed and any remaining documents revert back to individual Internet-Drafts.