Re: AD review: draft-ietf-kink-kink [section 1-4]

On Tue, 2005-01-18 at 14:31, Sam Hartman wrote:

> Section 4.4
> 
> IPsec does not allow half-open security associations any more as far
> as I can tell in 2401bis.  So it's not just for simplicity, but for
> model conformance.

Where is this "model conformance"? This is a kernel 
level suggestion at best, and if 2401bis forbids this,
nothing actually changes with the KINK protocol except
for the fact that it loses data which isn't KINK's fault,
but 2401bis' notion of "conformance". In any case, I 
don't see why we should change this especially since 2401
isn't broken in this way.

> Section 4.4.1:
> 
> Please make sure this discussion is aligned with 2401bis.  I think it
> may change small details but they seem to have adopted much of the
> same strategy kink uses.  The area wher I believe they speak to this
> issue is when you should rekey (timers etc)

This is a classic case of KINK being the _actual_ start
of IKEv2 and 2401bis. The main question I have is whether
there is something _wrong_ here. I really don't think it's
fair to just be sending us off on work assignments if there's
no reason to believe that what the draft states is incorrect.

> Section 4.4.2
> 
> [**] Discuss status message, rebooting peers and u2u.  This looks a
> lot like the IKE case where you lose all cryptographic context to me.

I don't understand what you want here. Are you saying that
this doesn't work in the u-u case? I don't understand what
u-u has to do with anything here.

		Mike

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iQCVAwUAQe/i/LMsDAj/Eq++AQINcwQAr9mPC+txhiTEVYNjefikRtUKc9hbWQZA
FlrdMRN+LBHzjhZgCGQ38/zExWOhO/86DZrgajuZAxQEotcioKkONJq8C3bNAPXd
qYRRaBQMBeglo1pbHUyldMOFOwC12O5rSIQ6AOxjJ3cbFWnjW9CWKtcW8Jv7glQn
lUNFYDbKNm8=
=3/Pw
-----END PGP SIGNATURE-----