The following errata report has been submitted for RFC8229,
"TCP Encapsulation of IKE and IPsec Packets".

You may review the report below and at:

Type: Technical
Reported by: Valery Smyslov <>

Section: GLOBAL

Original Text

Corrected Text
TCP provides reliable transport, so there is no need for applications 
to deal with retransmissions. Moreover, sending retransmissions by IKE 
in case of TCP on congested networks could further increase congestion 
and degrade performance. For this reason IKE initiators SHOULD NOT 
retransmit requests if they are sent over TCP. However, both IKE 
initiators and responders MUST correctly handle retransmitted messages 
received over TCP, but responders SHOULD NOT resend response messages 
in this case. If IKE initiators still choose to retransmit requests 
over TCP, then the retransmission policy SHOULD be less aggressive than 
it would have been in case of UDP.

While Section 12.2 discusses some implications that TCP transport could have on 
ESP protocol, the IKE retransmission behavior, described in Section 2.1 of 
RFC7296, is not redefined by this RFC. This is an oversight and some 
recommendations for implementers should have been given. The suggested text 
should be placed in a new section, presumably between sections 8 and 9.

This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

RFC8229 (draft-ietf-ipsecme-tcp-encaps-10)
Title               : TCP Encapsulation of IKE and IPsec Packets
Publication Date    : August 2017
Author(s)           : T. Pauly, S. Touati, R. Mantha
Category            : PROPOSED STANDARD
Source              : IP Security Maintenance and Extensions
Area                : Security
Stream              : IETF
Verifying Party     : IESG

IPsec mailing list

Reply via email to