Re: [IPsec] Next steps on TCP Encapsulation for IKEv2

2016-04-06 Thread Tommy Pauly
Hi Yoav, Thanks for the feedback. While I see the advantage of adding the magic value at the start of the non-TLS TCP stream, especially over port 443, this seems to require the document to even more explicitly discuss TLS. If implementations do end up using TLS, as I believe many will in

Re: [IPsec] Next steps on TCP Encapsulation for IKEv2

2016-04-05 Thread Yoav Nir
Hi, Tommy. The changes look fine, although I’m still not convinced we even need the TLS. But that’s for another thread. We foresee that most TCP encapsulation is likely to be in on port 443. I think TCP encapsulation of IKEv2/IPsec should be easily distinguishable from other types of traffic

[IPsec] Next steps on TCP Encapsulation for IKEv2

2016-04-05 Thread Tommy Pauly
Hello, At our meeting yesterday, we agreed that we want one more revision of draft-pauly-ipsecme-tcp-encaps-03 before putting it up for working group adoption to clear up a few concerns. Here are the changes we’re planning: 1. Reconcile the length field size with 3GPP’s recommendation (sent