Re: [IPsec] [Last-Call] [secdir] Secdir last call review of draft-ietf-ipsecme-qr-ikev2-09

2019-12-26 Thread Paul Wouters
On Wed, 25 Dec 2019, Valery Smyslov wrote: Uri, I don't mind referencing NIST levels, but I'd like to first hear from my co-authors, who are definitely more experienced in cryptography and in NIST levels than I am :-) I don't think mentioning the NIST competition is useful. Per definition,

Re: [IPsec] Labeled IPsec options

2019-12-26 Thread Paul Wouters
On Wed, 25 Dec 2019, Valery Smyslov wrote: Another approach - use some new status notification containing seclabel that the initiator would include in any request to create Child SA. This is easy to implement, but there is a possibility, that unsupporting responder will just ignore this notifica

Re: [IPsec] [Last-Call] [secdir] Secdir last call review of draft-ietf-ipsecme-qr-ikev2-09

2019-12-26 Thread Panos Kampanakis (pkampana)
To make sure we mention the NIST PQ Level categorization (that will not change as the NIST PQ Project progresses), I was thinking we could add something in the Sec Considerations section like [...] Because of this, the user SHOULD ensure that the post-quantum preshared key used has at le

[IPsec] I-D Action: draft-ietf-ipsecme-qr-ikev2-10.txt

2019-12-26 Thread internet-drafts
A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IP Security Maintenance and Extensions WG of the IETF. Title : Mixing Preshared Keys in IKEv2 for Post-quantum Resistance Authors : Scott Fluhrer

Re: [IPsec] I-D Action: draft-ietf-ipsecme-qr-ikev2-10.txt

2019-12-26 Thread Valery Smyslov
Hi, the -10 version of the draft addresses comments received during IETF LC and IANA review. Regards, Valery. > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the IP Security Maintenance and Extensions WG of > the IETF. > >

Re: [IPsec] Labeled IPsec options

2019-12-26 Thread Valery Smyslov
Hi Paul, > > Another approach - use some new status notification containing > > seclabel that the initiator would include in any request to create > > Child SA. This is easy to implement, but there is a possibility, > > that unsupporting responder will just ignore this notification > > and create