[IPsec] IANA registries and WESP

2024-02-05 Thread Daniel Migault
Just in case, this has not been reported earlier, I have the impression WESP should be indicated as an IPv6 Header Extension in [1]. If that is the case we should also add it there in the Header Extension registry in [2]. If we were to do some clean up [1] has a few missing keywords, and keywords

[IPsec] What's the most reasonable way for the responder to handle the request containing unknown Key Exchange methods

2024-02-05 Thread Tero Kivinen
Panwei \(William\) writes: > The handling I suggest is as follows: > > 1) if all KE methods proposed by the initiator are unknown to the > responder, i.e., no KE method is acceptable, then the responder replies > NO_PROPOSAL_CHOSEN, no matter what KE method is used in the KE payload. > >

Re: [IPsec] GDOI and G-IKEv2 payloads

2024-02-05 Thread Toerless Eckert
How would someone today do the equivalent of RFC8052 with G-IKEv2 ? On Mon, Feb 05, 2024 at 04:06:11AM +, Fries, Steffen wrote: > Hi, > > I've got a question regarding the relation of G-IKEv2 and GDOI. > > I realized that G-IKEv2 will be the successor of GDOI and would have a > question

Re: [IPsec] What's the most reasonable way for the responder to handle the request containing unknown Key Exchange methods

2024-02-05 Thread Paul Wouters
On Mon, 5 Feb 2024, Panwei (William) wrote: Regarding how the responder handles the request containing the new Key Exchange methods (old name was DH Group) that it doesn’t understand, I’ve had a discussion with someone, but we failed to agree with each other due to different interpretations

Re: [IPsec] GDOI and G-IKEv2 payloads

2024-02-05 Thread Fries, Steffen
Hi Valery, Thank you for the prompt answer. This is somehow what I have expected. Just wanted to double check. So there is at least the chance to proceed with the approach picked in RFC 8052. It still requires specification, but allows for taking the same approach. This would be important to

[IPsec] What's the most reasonable way for the responder to handle the request containing unknown Key Exchange methods

2024-02-05 Thread Panwei (William)
Hi folks, Several new Key Exchange methods were defined after RFC 7296 was published. (See https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-8) For example, RFC 8031 introduced two new KE methods, Curve25519 (KE Method ID = 31) and Curve448 (KE Method ID

Re: [IPsec] GDOI and G-IKEv2 payloads

2024-02-05 Thread Valery Smyslov
Hi Toerless, first G-IKEv2 should be published as RFC. The draft is currently in WGLC (for a long time), but received very few reviews so far (and many thanks to all who reviewed it!). I'm planning to publish an updated version addressing Daniel's review soon. Once G-IKEv2 is standardized, there