Subject: [Hipsec] HIP ESP, RFC5202-bis, version 02

From: Petri Jokela <[email-masked]>
Date: Sat, 28 Jan 2012 08:54:43 +0200

Hi, 

I updated the RFC5202-bis to -02 and the current pre-version can be found from: 

http://jokela.org/ietf/draft-jokela-rfc5202-bis-02-pre1.txt

The IESG note is not visible in that. The note said: 

        In case of complex Security Policy Databases (SPDs) and the
        co-existence of HIP and security-related protocols such as IKE,
        implementors may encounter conditions that are unspecified in
        these documents. For example, when the SPD defines an IP address
        subnet to be protected and a HIP host is residing in that IP
        address area, there is a possibility that the communication is
        encrypted multiple times. Readers are advised to pay special
        attention when running HIP with complex SPD settings. Future
        specifications should clearly define when multiple encryption is
        intended, and when it should be avoided.

The issue was fixed in the already expired draft version -01 (see section 3.4). The BEET mode was also added as an appendix (B) in the earlier version. I made some small modifications to the author list in this new -02 (Pekka wanted to be delisted) and acknowledgements (Pekka's contribution added). 

Any comments?

Petri

-- 
Petri Jokela
Research scientist
NomadicLab, Ericsson Research
Oy L M Ericsson Ab                  

E-mail: [email-masked]
Mobile: +358 44 299 2413

---

From: Miika Komu <[email-masked]>
Date: Sat, 28 Jan 2012 10:46:45 +0200

Hi,

On 28/01/12 08:54, Petri Jokela wrote:
> implementors may encounter conditions that are unspecified in these
> documents. For example, when the SPD defines an IP address subnet to
> be protected and a HIP host is residing in that IP address area,
> there is a possibility that the communication is encrypted multiple
> times. Readers are advised to pay special attention when running HIP
> with complex SPD settings. Future specifications should clearly
> define when multiple encryption is intended, and when it should be
> avoided.
>
> The issue was fixed in the already expired draft version -01 (see
> section 3.4). The BEET mode was also added as an appendix (B) in the
> earlier version. I made some small modifications to the author list
> in this new -02 (Pekka wanted to be delisted) and acknowledgements
> (Pekka's contribution added).
>
> Any comments?

seems ok to me.

---

From: Petri Jokela <[email-masked]>
Date: Sat, 28 Jan 2012 23:30:07 +0200

It seems that there I had a wrong xml-version and Jan had edited few lines for the official -01 version. This should now be the correct version, containing all the modifications:

http://jokela.org/ietf/draft-jokela-hip-rfc5202-bis-02-pre2.txt

Petri

On 28.1.2012, at 10.46, Miika Komu wrote:

> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Sun, 29 Jan 2012 21:15:11 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Petri Jokela
> Sent: Saturday, January 28, 2012 1:30 PM
> To: Miika Komu
> Cc: [email-masked]
> Subject: Re: [Hipsec] HIP ESP, RFC5202-bis, version 02
> 
> It seems that there I had a wrong xml-version and Jan had edited few
> lines for the official -01 version. This should now be the correct
> version, containing all the modifications:
> 

Petri, one small change:  the list of mandatory keying algorithms at the end of Section 7 hasn't been updated for the new mandatory algorithms (draft-ietf-hip-rfc5201-bis-07, Section 6.5).  However, I would recommend to instead reference Section 6.5 of RFC5201-bis rather than duplicate the text here (such as by saying "The number of bits drawn for a given algorithm is the "natural" size of the keys, as specified in Section 6.5 of [RFC5201-bis].")

Speaking of which, shouldn't RFC5201 be a normative reference?

I am not aware of any major open issues with this draft.

- Tom

---

From: Petri Jokela <[email-masked]>
Date: Mon, 30 Jan 2012 10:22:33 +0200

Hi, 

I updated the text in section 7. I also moved the 5201 reference to Normative. I think I have put it to the wrong place when I changed it from 5201 to 5201-bis.

Current version:
http://jokela.org/ietf/draft-jokela-hip-rfc5202-bis-02-pre3.txt

Petri