Re: [IPsec] Closing the IKEv2bis open issues

[Yoav Nir]

A few lines above this section it already says "If the responder's policy allows it to accept the first selector of TSi and TSr, then the responder MUST narrow the traffic selectors to a subset that includes the initiator's first choices."

On Oct 20, 2009, at 6:19 PM, Paul Hoffman wrote:

So there is a MUST requirement to select the initiator's first choice (if possible), so I don't think the SHOULD and MAY are appropriate here. The way I read this section, it only clarifies what to do if the initiator traffic selector (first or not) is too broad. In that case, we shouldn't mention the initiator's choices.

Issue #25, Choice of the right TS when narrowing

<snip/>

Proposed change:
  When narrowing is done, there may be several subsets that are
  acceptable but their union is not.  In this case, the responder
  SHOULD select the initiator's first choice (to be interoperable
  with RFC 4306), but MAY arbitrarily select any of them,
  and MAY include an
  ADDITIONAL_TS_POSSIBLE notification in the response.

smime.p7s
Description: S/MIME cryptographic signature

_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec