Internet Engineering Task Force 108, 28 Jul 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF108-IPSECME-20200728-1100

Description

IPSECME meeting session at IETF108
2020/07/28 1100

https://datatracker.ietf.org/meeting/108/proceedings/

A

Okay, I will restart this sprout.

B

C

C

You can do the fun thing with me, sharing the screen and then it looks like.

C

B

There's no way to sort of put yourself in the queue for speaking or.

C

Oh sure, there is um there's right where you uh asked for um one to the left of where you um just um started. Sending the audio there's a request, audio cue, or at least there should be.

B

I don't see the queue itself. Do you.

D

I see you in the queue, but if there's no one in the queue, there's no q to.

D

D

So like I can join the queue and you can see what that looks.

E

C

So if I did this.

C

Are you seeing this slide all over everything because uh I made it full screen, so it's hiding the um the chrome.

C

um Can you see the slides now.

D

Anyone seeing the um the application that would present the slides, but it's still in the not full screen mode so list of slides on the left. And it's a note well from the second slide, as well as the first line. So.

C

Clicking presentation doesn't do anything. Okay, that's good to know. I guess I could do it like this and then make this disappear and enlarge and it's sort of better but.

F

C

Pretty well yeah I'll, let the tarot sling the slides when it gets back.

A

Okay, I'm back. I will try to if you can. Okay.

C

I'll stop sharing okay,.

D

A

So you are seeing see my slide now.

C

A

Because I'm not seeing any videos still so I can't see my I can see my slides on my screen, but I can see them on the browser and I can see yours video on the browser. I can see that there is a video that is supposed to.

E

A

But for some reason it doesn't show anyway I can. I can leave with that. I don't need to see the slides. I can see them from my screen, but if something goes wrong with them, you need to tell me that if it's not sewing anymore.

C

Okay, I think the session's started. So uh let's uh get done with it. uh We go to the next slide and show the note well and even though the font is really really small, it doesn't really matter because we're all remote, so we've all got our reading glasses and we're seeing the small phone just fine.

C

Okay, so note the note well well and let's go on to the um blue sheets- are automatic here just by logging into meet echo you registered on the blue sheet. uh So we need a jabra scribe and two note takers and the links at least to the note-taking r on the agenda.

C

And do you really need a jabra scribe? What does a jabber squad do in a virtual meeting.

A

The most problem, the problem thing is that you can see that, if you are, you know going with the the uh the queue you can't see the chat unless you have a chapter client separately.

A

I have a separate jabra clan, so I can actually see what's happening there, but but jabber scribe would be useful to have somebody actually checking chubber and telling us if there's anything important there.

D

Yeah, I also have.

A

D

Jabber client and we'll try to be paying attention.

C

Okay, good, so um so we need volunteers for note-taking at least.

C

B

Linux set up to not crash out halfway.

A

That's why we want to have a tool and we are using the uh kodaim or what is that. I don't know how to spell that. One go with 19. yeah.

C

C

C

Okay, so we don't really need uh blow it blow, just uh any decisions made or ideas accepted or rejected or stuff like that.

A

And I have already pre-filled that one so that it actually has the you know all the all the titles and agenda and so on, so just need to type in what's happening with the discussion and so on.

C

Okay, um so oh yeah, so can you run? Oh, we just got follow anyone else.

A

There's a couple of people in the benedict and timothy chopper saying they can also okay. So it's a good thing if you have more than one people, because somebody might be discussing at the same time so.

C

Right: okay, great thanks! So uh let's go to the group status I think, is the next slide right. So we've got uh all the allocated time for technical difficulties, and- uh and this is the agenda, um any comments, anything we forgot um missing stuff yeah, remember that paul had something he wanted to discuss in any other business, but well we'll get to that.

C

um Okay. So anyone I'm not seeing anyone rushing to the queue so status.

C

Okay, since we last met which was in november- and I was even wasn't there um so implicitly- we got published as rfc, 8750 and um qrikv2 was published as rfc 8784, and I think for the first time in several years I don't have a draft in this working group, so yeah and we've requested publication for the ipv6 and ipv4 codes and that's the publication request and then we've got work in progress for the intermediate multiple ke iptfs labeled ipsec, which I don't think we've had much discussion about that recently and, of course, gi kv2, that's been going on since I think the first itf I ever attended, which was in 2007, so yeah that's been a long time coming.

C

uh Yeah next slide.

C

Okay, so we've got presentations and the first couple are from valerie. So next slide: okay, yeah valeria just come to the mic and I'll shut myself up. So it don't bother me.

F

Can you hear me.

A

Yes, we can hear.

F

You, okay, so hello, I'm valerie, and I'm going to make a few presentation today and the first is about update of discipline calculation of park in the episode package. Rfc 8229 uh net, please.

F

So this spin calculation was defined in 29 published uh a while ago and uh it modifies iq2 behavior in several ways. uh It uh there are very. uh Quite a lot of places when like to be heavier must be uh accommodated, uh must be handled differently compared with udp uh transport and while uh rfc tries to cover all these uh places and describe prescribe the new behavior.

F

It turned out after some implementation experience that some nuances wasn't covered in the rfc, and some of these nuances are just affect performance and probably very small other, but other effect.

A

Reliability and.

F

Interoperability, so there was a draft initially prepared.

A

E

F

Lists all these clarifications for therapy, but follow the uh our direct advice and our terrorist advice uh it. It was decided to instead to prepare- and this document for 22 82-29, so tommy and myself has prepared the draft that can be used as initial version of this document. Next, please so uh here I will try to cover uh just the differences that are not addressed in the current version of uh in the current review, and that must be addressed in this draft.

F

So first about the transmission.

F

So um I quit two requires exchange in the shelter to initialize, mid request, periodically and tcp is a reliable protocol, so the transmissions are not needed and, moreover, excessive transmissions may may make things worse because in case of congestion, uh any requests that can be done that will be done by application will always increase this congestion making sense worse. But in some cases for example, if this speculation is lost and then restored, then the transmission must.

E

F

So it is not covered in zero, it must be added to the next piece.

F

Next thing is about using cookie and puzzle and general cookie is not useful with dcp, because tcp verifies that it stays for protocol and it initiates connection, and it verifies that the p addressing is real, so there's no there's no there's very little sense to use.

F

On the other hand, puzzle can be used because it provides a different mechanism to to to defend against general distributed general service attack, and so cookie will be used only if puzzle is used, but of course, if cook is requested by the charter responders still need to handle it in this position. So next, please.

F

uh Another thing is uh error, handling in the.

A

F

So since uh udp.

A

Is a reliable transport.

F

uh Rfc uh 7296 device is initiated not to act immediately if it receives some error uh notification in the iksa indeed, but wait for some time, because this package can be forced, but in case of tcp it makes little sense because either we receive uh the error and it is a genuine error or it is forced, but if it is forced against this reconnection is hijacked and the genuine error will never never be received. So it must be also addressed in the revised interrupt next, please.

G

Probably most serious.

F

uh Issue with the current territory is an interaction with mobile and.

A

There are a couple of things that.

F

That uh that are uh important here.

A

F

Not detection uh ip contact must not be uh uh so sorry. uh uh Currently ruxin recommends that he can't be changed, that initiated structures tries uh to connect our will dp exacerbation and which is to tcp is not detection. uh Ip notification must be recalculated uh if source address was different.

A

F

And uh that's uh just to detect was another place is present, so at the same time, message id for tcp based exchange must remain the same, even if we switch to the different transport. So the next piece.

F

And another very important thing is an interaction with high availability clusters since gcp connection, uh when cluster is switched from basic to uh from active to basic node, uh the tcp connection will most probably will be lost because uh well, if it is, if it, if it survives, we have very reliable.

A

Clusters that duplicates basically.

F

Every tcp connection, but it is in most cases it is not realistic. So when tcp connection is lost and the responder, so the cluster, the initial respondent has something to send. It cannot do it so at the same time, the initiator- and it must say because, according to rfc.

A

7311, it must send.

F

A special package informing that message, id must be adjusted and sequence number might be adjusted, but it can do it because this reconnection is lost and the initial responder cannot restore it. It has no means to do it, so it's advising that client should periodically send learners, check messages, and it must do it more frequently and despite whether uh rails traffic exists or no uh despite, if there is a a traffic, it must not send, but if there is no traffic it must have periodically.

F

I must check that will restore tsp connection in case that cluster is switched to the the cut node next year.

F

So that's that's basically, uh most of the changes there are more worries, more uh changes that are less important, probably um that can be ignored, but that was covered most of the changes that are in the new document. So uh we're definitely looking for adoption of the document uh followed by our id uh advice.

F

So uh what the chair thinks.

C

B

um So just a few comments um uh I'll have to take a closer look at the draft, but I think uh there should probably also be a section about the kernel requirements um and things like what to do when you have like uh packets that are too small that that are smaller than a non-esp marker, because we we had a few bugs when we were implementing this in a linux kernel. I think those would be good to also incorporate into the document.

F

Yes, there is, there is a section that is concerned with uh ipsec, so the the how tcp encapsulation includes is influenced by the secretary. It is currently a bit short, but it definitely should be expanded. In particular, it says that, for example, you cannot have a multiple. uh You cannot copy course class field from um in a ip header to the outer.

A

F

A

Tcp of the tcp.

F

In the tcp stream of the package will have the same course class it's, for example, one application of tcp on ipc and sure this this section must be expanded. I agree.

B

And then one last question, um so I know we did. Some interrupt. Testing um have been any other vendors, yet who've done interrupt testing.

F

I believe so well initially, uh when this uh the rfc 8229 was implemented. I I remember that we have tested with at least apple and, uh as far as I remember with cisco is minimum.

B

Okay, I'm not sure how to remove myself from the cube.

C

I can do it for you, but you've got a button for stopping transmission. um Any other questions.

C

Okay, uh let's take a hum about how many people have actually read this, so go to the uh hum tool: tab virtual hum tool, tab! It's uh right! Next to the uh chat right left left of the chat and when I click the start button you will have a chance to say how loudly you want to hum so uh hum. Now, if you have read the draft.

C

Oh, it's going to take 30 seconds. Okay,.

C

We'll give you a good long time to decide whether you read the draft or not.

H

um By the way, if you don't want to hum just don't click anything.

C

Oh, and actually, if I remember correctly, it doesn't really matter because it just tells me how how loudly people come, not how many.

C

Okay, so yeah people hunt very, very softly pianissimo and that's really not very relatively new, so that's probably the case yeah. So uh if I ask now about how many people haven't read the draft and I get that it's 48 doesn't really say anything because it doesn't show me how many people hunt. So that's pretty useless.

C

um Okay. So, um since we can't really pull the rule for how many people have read the draft and there's also no point in uh well, perhaps there is a point in asking about uh you know adoption, or rather let's ask the participant to come to the queue and say, if you think, there's just adapting. This is a good idea.

C

B

uh Hi, so um I think it's a good idea to adopt. There were definitely while we were doing intro. There were definitely some unexpected issues, and I think that would be sad if that knowledge is lost, and I think it should be incorporated into the draft.

C

So you have a general sense that rfc 82 was it. 29 is an incomplete uh specification for doing a. I can type over tcp.

B

I think so, yes, based based on our implementation and the mistakes or the omissions that were made in our implementation. I think so. Yes,.

C

Okay, so the question we really would like to ask is if we need and if we need an update to 82.99, and uh if this is a good starting point- and I guess that's some question- that we will ask on the list.

C

A

Else this is, I think, actually, if I remember correct, our original charter was like tcp encapsulation uh clarifications, and then we decided to do the beast document and I think that's that's the real question now that.

C

So the question is: if this is a good starting point,.

A

Yeah yeah, I think we should probably take it to the list.

C

And we are watching we'll definitely take this to the list. Okay, so uh if nobody has anything else to add- and I guess we can move to valerie's second slide deck.

F

A

F

Item for us, it is called liquid configuration for encrypted dns, so uh this work was uh initially uh initiated by matt, tiro and then- and I was later joined, just to clarify things concerning with. I could do so please, so uh this is just a content of the presentation.

F

It's a simple sample use cases how it is integrated into ike and what next step next uh description of the program. So uh the recently several schemes to encrypt dns have been specified, it's dennis or with tls dot, dns or detailers dns over https doc and another scheme that is currently instantified in s or working.

F

So uh it's it's quite popular topic currently to to to make dns encrypted, and the question is how to securely uh provide clients uh with the configuration of encrypted dns, and so that can use it even within episode 2 of the next piece.

F

uh There are a couple of use cases just just to illustrate the problem. uh The first use case is the nasal.

E

F

So vpn service provider can offer publicly accessible encrypted dns outside its domain, so that dns, dns, dns server is, uh is not accessible or probably, maybe or may not be accessible. We are depend too now, so uh in this situation we have to uh since dns is encrypted. There is no it's protected, but we have to configure client to with configuration and how to use it encrypted dns outside the tone and the next use case next piece.

F

It's it's protected internal dns traffic. So our recent research uh recent trends treat even internal hosts in the protected networks as acceptable to to to be attacked, and so, in this case, encrypted dns can benefit uh so that the dns traffic is encrypted even inside the uh protected boundary, so so called zero trust architecture.

F

B

F

So uh how to solve this problem.

A

And we use uh and I a ui.

F

Configuration attribute to convey information uh concerned with encrypted dns to from server to the client. It's called internal and dns, and it has follow information inside so.

A

F

Type of encrypted dns, either it is dot or probably doc and over quick in future. Currently, it is not yet defined the scope of dns use, whether it is which is intended to use on the inside uh the pen tunnel or either or also outside.

E

F

And the server address itself and the encrypted domain encrypted dns domain fully qualified the money. So this attribute is exchanging the icos exchange loan without attributing cap again requesting category reply. uh Is configuration condo, that's the next piece, so the attribute format is is.

E

Denoted in this picture.

F

uh It has uh one bit that defines the scope. uh 7B is the defined subtype of encrypted dns.

A

F

Followed by the.

A

F

One of more uh ip addresses for the dns server all addresses are encoded, as ipv6 addresses and ipv4 addresses are included, using the mapping from ipv4 to ipv6 and then the authentication domain name.

F

So that's quite simple, so the next please.

F

So there is uh one subtle thing that.

A

These uh drafted.

F

Drug houses into the drafting trucks with split dns extension, uh currently rfc, uh 85, 1998 split dns configuration for iq2 requires that internal ipdns attributes be present. When you turn the nest domain is included, since this attribute includes both address and domain. So this requirement is uh relaxed if these traffic implements so the next piece.

F

So next steps, uh I think, from conversation with my co-authors, that this group is not considered as a primary home group candidate, so they wanted initially, they directed the drug to be adopted and progressed in the working group. But since this is concerned with uh ike, I think it is of interest for this group. Probably uh happy second year can be home for this draft. If the group decides it is interesting.

F

So what's your opinion? Thank.

F

C

C

C

Paul, can you speak up, we're not hearing you.

B

Oops, I had another mute button. Sorry um so I think the draft's good, um uh the on my only concern is with the the bit that says something about what to do outside of the vpn tunnel. I think that's sort of out of scope for for for ike to say what you should do outside of the vpn. So I think it should. I agree to define like you know, these are the dns servers you can reach on on various protocol flavors.

B

But I'm not sure if it's just to say something about. Oh and here's, some information that you can use, even if the vpn is down, then you can use this. That seems a bit scary to me and out of scope.

F

um Well, I cannot.

H

F

Comment on this because it's it's mostly I'm not expecting ecliptic dennis so that my courses will probably also better than uh myself but as far as I understand, they feel that this is a very interesting scenario when the dns initially is offloaded outside the pen, provided so that uh all the ds queries are encrypted, but the dns provider is different from the 10 provider.

F

So that's an interesting use case.

D

Okay, uh I had a couple comments, so the first one is. I think you already noted that there is the add working group that is charted to do things, uh at least in this space. So you should be sure to have the respect. Working group chairs coordinate to make sure that we have one proper home for the work, but I'm sure we can do that, and my other comment was that in the the slide with the attribute format, you are showing the ip address and the dns authentication domain name.

D

But my understanding is that for do you have to provide a uri template and not just the exact name.

F

Thank you first first about the first question uh this draft. This presentation was also requested to be done in the add working group in this itf, but uh because of very tight agenda.

F

uh The add working group chairs decided to to not to grant this presentation this particular presentation, but they are aware of it, and the akt working group is the primary.

A

F

Budget home working group for this drug and for the uh second question so the next slightly and next the reason it becomes slide. Well, there are some dark specifics that are not covered in the draft, and that is because this is where it is. It is a bit outside of ipsec.

F

We decided to make this because, like not to present it initially, so uh exactly for the joke, you have to somehow now we templates for for the uh dock services.

A

And, as far as I understand.

F

It it will be covered in details in draft btv, add rfc 8040 for clarification, but the idea is that there is a well-known uh ue where this template can be discovered.

D

Yeah, we'll definitely have to follow that work to uh stand on track uh and, of course, when dns over quick arrives, we don't know yet what kind of configuration it will need, so just to make sure that our attribute format is sufficiently flexible, that we can uh extend to new types of data if we need to uh but yeah. I think this is interesting. Work.

A

So to start giving it so so you would be saying that instead of having this kind of thing, we probably should have you know sub attributes inside that think that we could have a multiple different type of things, especially if we see that there's going to be perhaps need for other type of configuration. Attributes for different types of you know things we are configuring or the other option, of course, is to make you know multiple.

A

uh You know, because we have this list of. You know configuration attributes already, so we could, you know just do it so that we move this one level up like we did for ipv4 and ipv6. We have a different uh payload for ipv4 dns addresses and different for ipv6 dns addresses. We could have an one format, for you know uh dot uh one uh format for the hda, oh and one for a quick, because we have a 16 bit attribute type. There.

F

I understand, but we try to simplify things and to come up with a single attribute. Just that can be.

A

The question is, question is: is it simplifying or not, because I think that you know if we have one level of interaction, one level of listing or nesting already up layer, and we have a 16 bit so we can. Actually, you know we can allocate multiple of those attribute types.

B

A

Different things, so so it's just you know having less internal structure and more of the using the already existing higher level structure.

C

Okay, so um yeah. This is the oven here. uh Speaking with snow hats, um I admit I haven't read the draft, but uh just looking at the presentation, I think there's something missing in their motivation.

C

um The big motivation as far as I'm concerned is that the world, or at least the world in the itf, is moving to encrypted um dns and we don't want to have uh to keep the old unencrypted dns just for the sake of the ikv2 server. That's uh that doesn't know how to handle input the dns, so uh we needed if for no other reason, we needed to keep up with the times because dna, because we don't want to force people to keep the unique guinness.

F

uh It's one of the reasons because, as uh of course, it's jiro probably will comment uh better on it. But as far as I understand many browsers with soon uh have an encrypted dns uh turned on by default, and they will display a warning if you use some encrypted dns. So we should be uh prepared with this with ip2, so that users don't see this warning when they use. uh I don't know likely to I decide to connect to the uh you, can correct.

C

With that, we have two other people in the queue. So let's hear from them, please just state your name before you ask your question.

I

One of the co-authors of the wrap, the dean's authentication domain name, can be used by all the three flavors of uh danish encryption, both amos or dls, dns, https, and so quick. um These https or the next uh https three are required, uri to be discovered and that uri discovered can be done securely using well-known domain name. So that is the client first establishes the tls handshake and then uses the uri to retrieve the well known url to retrieve all the reverse services. The services could be like. I can do malware frames.

I

I can uh block phishing sites so the various services. I don't need any filtrate from the us service. So those.

A

Are the various.

I

Flavors of the wire that could be discovered by the flag and the client can decide to pick whichever our service uh reports to use from thirty or so uh that discovery is already discussed as part of.

C

F

Okay, yeah gallery.

F

Sorry, the connection was what uh yeah.

A

F

A

I

The uri services can be discovered using the well-known uh url link and that's already being discussed as part of that. That's the reason it's not covered.

C

So if I understand correctly, the comment is that the url can be discovered in some other way and we don't have to send it uh explicitly.

C

Yes, I see um okay, so I guess that's something that valerie needs to discuss with the add people.

C

Okay, so uh next one in the queue um benedict.

G

Okay, um so maybe this was. This was the context of the previous question and I just didn't quite get it um force. My understanding was that for some dns services like dns over tlrx, uh we need or hoping to do, certificate validation is that is that the same context as a previous question, or, if not, is that something that we maybe can just send a string and then do the dns we would have to do it. We would have a bootstrapping problem, but we would be able.

I

To evaluate yeah, the the ad working group is currently only discussing uh certificates which are became based. uh We are not discussing any uh certificates which are using uh private ca or uh or raw public keys. So that's reason in this graph: we are only covering authentication domain name, because the certificate would have that and a client would still use pk to validate the certificate.

G

C

Any more questions.

C

Okay, so uh valerie are you right now calling for adoption of this or or what.

F

uh I think that the hdd working group is a primarily primary uh target home working group for this drought. So as far as I understand from my conversation with steroids, so it's probably in this working group is just for information. But if there is an interesting interest in looking.

F

Group instead, but.

F

E

F

Not calling for adoption right now, okay,.

I

Yeah, I think I think we need a couple of more revisions for this drought before I think it's ready, but uh we would definitely like to present this drought in ad working group as well, and we would like the chairs of both this working group and recorded and uh because this is an extension to like it. It definitely falls into this, but uh chatter as well, but uh you will also be aware of the work that's happening here, so I guess some discussions have to happen in both.

I

uh So we wanted to uh make sure that both the working groups are aware of this work and uh we don't want it to be developing okay.

D

Make sense yeah just uh this has been chaotix to note as the area director. If this working group might beseck me decided to say that this work is terrible and you shouldn't do it. That would be very useful information for add to have. I don't see that happening, of course, but to be able to say that we saw the work and it seems to make sense, is useful information to have.

I

I had one comment to add is currently: if you see uh most of the drafts that are discussed in ad are basically using insecure mechanisms to discover uh the duty level servers either it could be dhcp routing advertisement or it could be. I have a domain, especially it has a domain name which the client queries in venus or 533 to retrieve whether the network supports dvd audio.

I

This is the only uh uh only secure mechanism, that's being discussed, which make sure that it's not an attacker who is providing a divorce device server rather than it's it's the server which is hosted by the vpn provider, so that makes it quite unique and probably different from the vpn use case compared to the other cases, uh that's being discussed in advertising.

C

Okay, so with that, let's go to valerie's uh third and last uh because we're already about seven minutes behind schedule, so that'll become.

F

A little bit faster so announcing supported, authentication method. It might be to the next place.

F

So you know that unlikely one authentication method like we do is not negotiated so that the hpa is free to use whatever it. It thinks is acceptable and appropriate and in general it works.

F

It works well if there is no ambiguity selected in choosing a multi-server method, but if peers can use several messages, indicate each other so that it is possible that that, in the share to select authentication method and supported by the responder, the next please and the problem that we got to encountered a few years ago, when our selfies signature from multiplayer to magnitude, new initiatives tried to use pss signature, while all the respondents didn't support it, sending back authentication failed.

F

So of course, if initiating, if initiators, knew respondus capabilities, they would have chosen excess pixels one and they say succeeded so the next piece and uh social. The problem that there is no currently there is no way for peace for peers to explicitly indicate the supported, authentication method.

E

There are some.

F

It's the euristic mechanisms that can be done using uh cert request, reload, for example, or id content, but all of them are unreliable and I think that with new signature formats and authentication method, especially uh post quantum and hybrid ones, that are already discussed in uh the last working group uh in the kids working group, there are some drugs. The station of this election might happen more often as the next piece and.

J

F

Solution is to uh add the new notification supported house method uh to indicate the supported authentication method, so that is an optional notification that each player can send to each other uh and for certificate based authentication.

F

uh It's it's useful to enter the ability for the piece to indicate which signing message can be due to visit with each of the ce in the search request, reload and another thing that is desirable and avoid creating new ion registers for them. So next, please.

F

So uh the formation of identification is a list of supported authentication methods of which each of them is represented, using three three possible formats. A two octet format for a very simple method like pre-sharing, key or another authentication reacted format that.

A

Is for message that can be linked.

F

To rsi to sorry to set requests below and multiple mods that actually for the currently its only method, uh signature, digital signature- it contains some grease identifier to completely identify uh this signature algorithm that can be used for for this authentication man and the linking is done by pointing to the content of search request below uh that can illustrate it on the next slide next piece.

F

uh So this is an illustration of how the linking to the to the search request below it is done. So each authentication method contains a field, a subfield called link, and it contains ic, zero or non-zero value. If it is not zero, it is uh it points. This value is treated as a number. The uh the the sequence number of uh c is in the start, request below.

F

If it is zero, it means that this particular citation method can use with any series, or it isn't concerned with this, so the next, please so uh how it is exchanged. Since uh there are two options option one is very simple: uh it is uh exchange along with set requests below it, so, each time uh the psn centric has below it. It also includes the put it out method.

F

Next, please, the problem with the first option is that supported house messaging education can be quite long because you can support quite a lot of methods in since the aggregation identifiers. I send you, I send a centered. One conversion identifies it included, they get the quantum several hundred points. So in this case we can use ice intermediate exchange that is used for other purposes currently for multiple key exchanges and, for example, we can use it for other purpose. So if respondent.

A

F

That the size of the its response will be too too large and caused ip fragmentation in consent, supported in empty supported, house method, method, certification, and that is a hint for initiators that it must initiate, like intermediate exchange or piggyback if academic exchange is initiated for some other purpose. And so is this like an immediate exchange, the respondent will include incentification so for the shutters there's, no problem because it gets close.

F

So the next piece, so I try to be very quick. uh I I want to say that this particular.

A

F

This particular topic is in the episcopal charter and we don't yet have a candidate for candidate draft to solve this problem. So I think that probably this.

A

F

Can be treated as a candidate and can be adopted as such. So thank.

C

B

Hi paul vader speaking, um I think this this chart is a good idea, I'm not sure yet about whether all the complexity is needed. um But I did want to point out that um for liberson we went into we had a similar issue. We wanted to support null encryption on both sides and then slowly have people be able to migrate to certificates, um and we couldn't really signal that so.

E

What we we ended up.

B

Doing a custom.

B

A custom payload where we did the ppk trick and um and speaking of that so so in that sense, I think doing this in the standardized ways is good and I would I would support it.

B

um I would like to maybe see the ppk hack also merge into this, so that we can do this properly with this method and then maybe in the future, you know obsolete that ppk auth hack for those who don't know with ppk, you basically send two auth payloads differently calculated and then, but but with this draft you could just send the one that you think is.

B

A

Oh, it's still going in that's a not cheer, but I think uh one of the things we would probably do also. We could actually split this in two pieces, uh meaning one to negotiate actual authentication algorithm. The other one is the problem that uh which you know, methods are suitable for each ca and and having the linking back and forth with the certificate. Payload said with requests and so on.

A

That's gets very messy, so I was actually thinking, but it might be better to have this information. You have there in in this one to having this information about agreement ids to be inside the certificate request itself.

A

So we'd have a list of you know, supported authentication maker, which says on the psk signatures and and rc, and so on. Whatever formats you have, but the list of you know suitable agreement, ids would be inside the threats with requests, meaning that we actually allocate one new, circuitry curse type. That has you know in addition to having to hash of the ca, we also would have- and you know a list of oils that it's you know by this. It supports or something like that.

A

It would actually perhaps hotend the list or make it a little bit easier to parse. I don't know.

C

Okay, scott.

C

Scott, are you by accident meeting, muted.

C

Because we're not hearing you at all.

C

Okay, uh anyone else.

C

Okay, so um are you looking for adoption on this one? ah Yes, okay, so like everything else, we'll take it to the list because we're a little behind schedule and okay. So uh next slide too.

C

So now michael rosberg is gonna. Do the uh pitch for improvements proposed improvements to esp.

J

Hi everybody, um so let's take the next slide already. So um what we did was we looked at esp and data centers and we come into a couple of problems and we had two major issues and one was that the sequence numbers are not handled in esp as we want them to be handled, so maybe a pretty um subjective view. But that gives us problems with parallelism and it gives us problems with multicast replay protection, which we see in data centers right now, and it also gives us issues with qs.

J

There are a couple of ways around that right now being discussed, but it all boils down to the problem that sequence numbers are bound to an spi basically, and the other thing that we had was a well-known problem to this group is that esp trailers forces us to do complex protocol handling. So if we have fragments, if we have segments and maybe alignment issues, then this trailer comes into our way and what we did was we.

J

We exchanged things in messed with esp a little, and what I want to do now is to give you a short explanation of what we did with it, even though we don't know yet what we can do with that. So what we currently have, we have an implementation of it, but we don't know if that's worth a new protocol, a new version, a different mode, different yeah, just encapsulation method, next piece.

J

So what we did was we kept basically the spi where it stays, but um between the spi and the sequence number we introduce another field of basically two other fields and they indicate which window, which we introduced, multiple windows and for each sender or if you have one sender, that can also introduce different windows for different eqs classes and uh maybe um for different cpu cores and then have every cpu core or whatever or sender, have its own sequence numbers and what we also did was we introduced a larger sequence number field to.

J

We basically send all with the whole 64 bit of sequence, number information which we have for esn anyways, but if we explicitly send them with every packet, we don't have synchronization problems, especially if you have. If we were talking about one having one key and a whole data center and large multi-pass groups, then we had this synchronization problem.

J

um Furthermore, uh we shifted the icv value from the from the trailer to the beginning and in the header, which allows us um to make assumptions for an example that the sec there is it's always present in the first segment or it's always present in the first um fragment and um the it's all followed by the encrypted packet. What we got rid of is the whole trailer.

J

That means the padding is done now, implicitly like it is done for um for traffic flow confidentiality anyways. So and um if, as long as you do tunnel mode, that's not a problem. If you did something else, that's a different point of discussion, but we don't want to do that here.

J

We I want to just tell you today about what we did to the tunnel mode, and so we can get rid of the padding actually and also the pet length field, and also the next header field is actually not required, because either you send ipv4 or ipv6, and you can just always look at the first nibble that simplifies packets and law packet processing, a lot next place, and it allows us to have multiple replay windows per security and they're just identified by the sender id and the window id.

J

As I said, and it allows us to scale over more cpu cores without having additional things done in the group product or in the key management protocol. And it allows us to do multicast replay protection, as each sender can just use its own sequence number window, and it allows us also to do replay windows, qs class. In this case the sender just uses different window ids for different qs classes, and they can just overtake what I have not discussed in detail here.

J

But we all use the sender id the window nd and the sequence number as an initialization vector to the encryption, and this allows us to do implicit, um yeah, implicit um in implicit iv, and allows us to get a little bit more performance because we don't don't need additional authenticated data anymore.

J

Everything anything anything changed in any field in the in the header leads to a decryption or failed decryption. Thus, an attacker cannot do that and without aad we can faster encrypt things, because we don't need an additional round, for example in gcm and um well we had. We have also implicit padding so um now. I know this is kind of a large change. So that's why I wanted to discuss it before. Just writing. Some drafts or um yeah have feedback here from the group.

J

um What we intend to do is something like we don't want to replace fully uh esp with it, but have it somehow somehow negotiated if you're running it in a data center or so, and you could use that mode which is tuned to having fast performance implementations, and you could just do it so by an sbi basis, and you can decide in a for example, in the next column, if you encrypt it with if the packet was encrypted with that mode or just normal esp next, please, and this just to show you um how much performance you can get from such an implementation.

J

So this is just a measurement we have. We did on a broadwell cpu and it shows you different uh performance figures for esp vanilla, esp security association and that's our approach, which we call vpe, and what you can see is that you can run it at about 30 gigabit per second lines: 70 gigabit per second on the red side, so on the unencrypted site and have pretty much high performance from the approach.

J

Okay! Next, please!

J

So um thanks for listening! um What I'm interested in is um feedback from you, so we can decide on how to incorporate things uh into a draft or if we can should just um yeah, have it somewhere um yeah. I have just an information graph for an example or just that things are not a good idea. Maybe also would be outcome.

J

Okay, any questions.

C

Dropped um so I'll see something there's already a live discussion going on.

A

C

The list- and I think informational is definitely the wrong thing, because they're trying to change an underwire protocol, so that's either experimental or standard track, but definitely not informational, not telling.

A

C

Something now whether it's a good idea, that's already being hashed out on the list and if you read the uh um jabber room or it's also in the uh mythical, I think there's quite a bit of discussion right now and um yeah. So um yeah there's. Definitely there's no consensus about this. But uh there's a lot of.

A

This is not in our charter currently, and I think this is actually going to be a little bit bigger change and so there's so many things.

A

People want to do when when we start messing up with the esp protocol, so I think we might take a couple of minutes of very short comments, but I think we need to start working on this in the list first and see if it's actually a good idea until because I think if you start discussing the other proposals and of things we can do, we will take the whole time of the rest of the session right.

A

But we can take a couple of minutes for a short comment. If anybody has any comments.

B

A

We can just assume that we move to the discussion to the list.

C

And at some point maybe you'd want to have a virtual interim about it if there's enough interest. So um anyone uh still want to comment uh here.

C

Okay, so I'm not! This is not the dismissive, take it to the list, because it's already discussed on the list and there's a lot to say on the list.

C

Okay, so the people who only commented in the jab room uh we'll take that to the list as well. Okay, so uh let's go with the next slide.

C

So uh christian and about traffic for security and we're, starting with the presentation about the thing that is already uh in the charter and being worked on.

H

Yeah hi, is it oh good? It looks like my audio is coming through um hi, I'm christian hopps with lavin consulting, and this is an update uh right. It showed on the um status slides. This was an individual draft, but we adopted this a while back. So it's a working group document now uh these uh so next slide please.

H

So this is an update since uh 106. we didn't meet in 107., um uh so this was published prior to 107 back in march. uh The notable changes uh these were. uh Changes were asked for um at 106 and on the list the two big ones were, uh or the biggest one was the v2 I I had had used transforms and um paul, and some others said this is a silly way to do this and yeah. They were right.

H

So uh let's go to the next slide, so uh we switched to basically to enable tf iptfs. uh We use a notification, uh it's the same sort of method as the transport mode. um The only thing the thing that's different there is that we have we added a required flags payload to the notification.

H

If the required flags are not understood or or they are uh or supported, uh the tfs mode would not be enabled by the responder or the. If it's the initiator, that's getting back a required flags field that it doesn't support. It would then delete the essay so which is following the basic method next slide.

H

So the two required notification flags are congestion control, whether you know the basically, if it's set, the sender is asking the receiver to send it back congestion, control, information, uh periodically, it must be sent and if the so, if the receiver doesn't support sending that information, it would then not not set up tfs the don't fragment bit. This was required a while ago, but we're just continuing to bring that forward, which is, if the sender, uh the sender, the notify message does not support receiving uh fragments.

H

So next slide we changed the because we're looking at doing a protocol number. um We wanted to make it as generic as possible so that we could really not. You know, have any sort of trouble with this. So we used basically a first octet subtype, um which then allows basically for for the ipfs protocol number. You know we will have 255 256 uses of different header formats if we needed them, um even if they were not tfs.

H

This would be a way to extend the payload types next slide.

H

So with that change, then these are the new header formats. uh Subtype zero is the non-congestion control payload format. That's a type 0 reserved bits which this used to be a 16-bit flag field. Basically, that was all zeros and no other changes. Next slide.

H

Congestion control, uh payload format goes to subtype one and that did have a flag, which is that uh whether ec bits were used in calculating the data that it's returning and that that's the p flag, the rest of the flag bits are reserved and the rest of the header stays. The same looks like uh disliked, so uh we had a couple open issues uh and the comments from last meeting and one was the ip protocol number. uh We discussed this in the list a couple times.

H

I I think we've done done discussing it, so uh we're just waiting for the chairs to forward the request. We've got a summary there. You know. Basically, we looked at using what, um uh but it didn't really gain us anything. We still needed the next header number, so we just were burning some extra bits and bandwidths.

H

um So the what we agreed on was to you know, let's start an early allocation process. This will let us get through the any kind of issues that might come up um and you know we can deal with them so that it's not happening at the very end of the process uh and even if we did run into some problems, which we really don't anticipate that you know once we justify the use.

H

But if we did, uh we can always fall back to uh overloading an ip protocol number, but this really isn't where we want to start right, because I mean there's already people that are thinking that they might be able to use this framing outside of esp and the minute you leave esp. Then you can't, you know you can't just use an overloaded ip protocol number anymore.

H

um So anyway, there's a lot of ip protocol numbers. uh It is a. It is a you know, an 8-bit field, but it's more than half are left and a bunch can be deprecated so um and yeah. Well, let me come back to that, so the tr, the other, the other major thing, was transport mode, and we discussed this on the list and decided that this could be done in a separate document. There are uh there are some real?

H

You know it depends on how far we want to go with supporting transport mode if it's just to support gre the cu. You know the cisco sort of uh gre with transport mode tunnel. um It's fairly easy to do this, but if you want to get any more generic, you have to start talking about what ip fields to carry because you're you know you're carrying multiple iv packets in each um in each outer ip, uh certainly because you'll be creating like pad packets right. So what what ip fields do they carry?

H

Do they carry the last ones anyway? All of that sort of stuff can be discussed in a separate document, and you know that we can move the simpler method, the tunnel mode forward, so that seemed to go uh fine. Everyone just wanted to make sure that we, you know that it doesn't conflict with the tunnel mode and basically uh you know, since we have the subtypes, we also have flags and even the mode itself of going transport mode can differentiate any header changes we might need in the future.

H

um So uh anyway, coming back thro, throwing it back to ip number. um We do have the a.d in the room and the chairs are here, so I'm wondering if we can, could we make it? Can we make that official, uh maybe I'll, leave that question to the very end of the presentation, though, um let's go to the next slide, um the other. The other issues that we were looking at was possibly doing an alignment.

H

So I went and looked at this while I was I've been doing working on this a reference implementation of this and what the cons are, basically that it complicates uh the end cap dcap to do you know, uh alignment between the data blocks or you know the inner packets in the payload. uh It also wastes bandwidth the pro the reason to do it was basically to make it. You know less rigorous white box code to work like asics.

H

Don't have a problem with this at all, but you know if the code is sort of sloppy and tries to you know, pull a length field from an odd thing you know can slow down on some processors. You know like some of the old risk processors used to throw an exception.

H

You know that had to be handled in the kernel, but in any case, what you end up finding is that even when you're doing chained buffers, even when you're doing chain buffers, you end up having to parse the packet to find you know, you have to parse the packet to find the header and you're you're, always doing a copy out of the packet header just because you've already cash loaded it right. So when I went to find the header I've already loaded, the first 64 bytes of the packet into the cache anyway.

H

So as a way to make you know efficiently coding this, you always create the first of the chain. You're copying the cop, the packet header in any way, so it'll be aligned, but that's the key. So you end up without alignment issues even without aligning the data in the in the payload.

H

So basically the the just seems like we don't need this and it keeps things simple. uh The other thing is that we we are we're still planning to. uh We've got a vpp implementation that we'll be publishing this year, open source with congestion control and the ikev2 changes, and we're also very interested in working with other people and collaborating on other implementations. Are interoperability testing um next slide.

H

So uh we're wondering if there's any more comments and uh if we're ready to go to what uh working last call.

C

Okay, since no one's at the queue uh I'll speak first, um so the thing that concerns me about this document is that I don't think it got a lot of review and yeah working group last call is one way to get it, um but another thing I think we might do is uh ask for a transport directorate early transport directorate for you, because they usually have uh stuff to say about um documents like this, and so, if anybody has another idea of how we can get more review for this, uh that's that would also be great, because yeah working with last call is one way, but um I don't know if it's the best way.

A

uh This is, I have been you know. I haven't actually been following this discussion that much except for the protocol number, and I was there when the vesp protocol number was allocated, and I think you have a very or or it might be, that the change protocols have changed slightly heavily, but at that point it was really really hard to get the protocol number of yp.

A

We have to fight it, because why do you need two? Are you already have two? Why do you need third one, and that was one of the problems we had at that point? It might have changed the uh the question I have there is that the how many people have accidentally read these documents? So if people could actually, you know just uh type into their job or you know, you know if you have read it so so we can actually see if there is.

A

You know enough people to actually be reading this to be able to start working group last cause. If you have you know only five people reading it there's really no point of starting really. We need need a bit more people.

A

We see only one now and that's one so.

H

I mean I would I would be happy with five of the experts right. I I did get the feeling that we were getting. You know some of the experts here reviewing it, but that's just my experience from you know: lsr working group right if you get five of your experts, that's a pretty good review. All.

A

Right, yeah yeah, so we seem to be having about five people who have said that they have read the draft. uh Okay, do you have somebody in the cube.

C

K

Hear him lou uh hi, blue burger, I was just gonna say I don't think getting a protocol number is such a big deal. I went through the protocol list and there's quite a number that are really old and could be deprecated. I actually talked to someone else who has some protocol numbers assigned to them.

K

And about doing a deprecation draft and his response is why it's easy to get them and no one's really going after them. So I I don't think getting a critical number.

C

Okay, see that's right.

A

Does the ad have any comments about the protocol number stuff, because I think you are the one who are probably going to be? My understanding is going to be doing the work anyway right.

D

My understanding is also that the ad is involved in making the request.

D

I am happy to send something along, so if we can get a fully filled out protocol uh allocation or so if we can get a fully filled out registration template, uh I'm happy to send that, along to the right place,.

H

Well and thankfully I sent that to the to the chairs, I'm trying to cover all the bases, so I went to the uh I went to the protocol request, form and filled out all this stuff, so yeah yeah. The process is supposed to.

D

Be that the uh the request is made of the chairs and the chairs are supposed to send us the ad and then the ad will approve it right and get.

C

Okay, so any objections there for early uh transport directorate review because, as far as I remember- and they have six months ago- it's uh pretty complicated things, but a lot of moving parts.

C

So, okay, so with no objections I'll make the request. Okay! So now we're just uh one minute uh behind schedule, so we can uh move to the other presentation about something that is not currently working with him.

H

Correct uh so this is in other working groups. Everyone's favorite past time is talk about yang, so a colleague of mine, don paddock, has uh is also in the room to take questions too. We would put together a yang model for to support management of the iptfs next slide.

H

So basically, we have two things: configuration and operational data. The configuration is whether to turn on or not, congestion, control, uh the fixed packet size or you know so, there's two ways to specify that either just a fixed size or um to use path, mtu uh or the combination where you could say like, for example, we want 1500 octet uh but use path mtu to lo, so we could lower it.

H

The other configuration item is the bit rate to send at so you know, there's two ways we found it was actually useful, more useful to specify the l2 bit rate, because you know, if you know I want to use. You know, 100 of this ethernet or 10 of this ethernet link bandwidth. People just tend to think more of that right. I've got a 10, gig or 100 gig link, um and then you know so. Obviously the little gray box is saying you know the packet transmission frequencies of that rate divided by package size.

H

uh The last uh configuration is to whether to allow fragmentation or not of the inner data box next slide. So this is what that looks like we um we're I'll get to the model that we're augmenting, but basically this model has an ike and a iklis entry. So for ike mode we augment the connection entry under the sa configuration, and this is just the yang tree right.

H

So you can see the congestion control boolean, the packet size, uh the choice of a tunnel rate either l2 or l3, and they don't fragment and then um likewise we the the way yang works. Is you have you know the requested config? So that's what the upper one is, the lower one is what it's selected- and this is.

H

This is sort of useful, for example, think about how if you set um use path mtu, but you didn't specify an outer packet size, uh you would be able to look up in the operational state and see outer packet size, and that would actually be the size that the cathemteu had selected next slide.

H

uh This is just the same exact config, but it's in this case it's in the iklis uh module, and so it's under the spd entry um that, by the way that this is actually a grouping because the connection entry used spd entry. So it is the the same, we're augmenting the same grouping basically and ike and iquis um in in this case. We augment these um security association database entry, the sa basically for the operational config, so that that's what I noted there it's different from ike, because it's now under the sad entry next slide.

H

So the operational statistics- um these are pretty straightforward: we've got the outer ipsec counters, which is basically txrx, drops and error counts, and then we've got more detail with the inner packets. We track the number of um inner packets and octets uh the amount of padding that was added. So we we break the padding up into two different counters.

H

One is the padding that we added to so, in other words, a iptfs packet that included user traffic, um but also padding that's extra pad, uh but then there's also times where you're just sending an an entire ptfs payload of a pad. So that's what's counted by the all pad um and the same same counters for receive uh the error would be like a framing format um and the mist is where you're, not you know, you've seen a sequence number miss incomplete is similar. um It's where you might have missed.

H

uh If you, if you have a fragment that spanned a couple tfs and you missed part of you- know, missed one of them, it would count as an incomplete next slide.

H

So this is this is just those stats underneath the in this case the ike. It goes underneath. Child essay info and then the next slide, you'll see it in the uh under the sad entry in the next slide.

H

Oh, we did sorry so now here's the issue. So the the thing is: there's only one active, ipsec yang model out there and it's being defined by i2 nsf and, as you can see the name sdn, it's the only active, published ipsec game model, so we used it. It is very far along in the process, it's in the iesg publication, so there it's still um it's still in that in that process.

H

But when, if it completes that process, then it's an ietf last call and then it would become an rfc, but anyway it's there and it's it's pretty good. So we we augmented that for now there's also an expired draft. I guess maybe the author's probably worked from that one, but that one is expired.

H

Not moving forward um next slide, please so the issues with the sdn nikesec model it. Basically it provides a ike, an iklas operation. It also uses an ike common, so there's three modules I common used by both of the ike and the iqs modules, the ike module. This is one of the issues we ran into.

H

It doesn't include a security association database and I asked the authors and the reason they said was they don't care um because they, the the sdn mod model, is set up to be controlled by a centralized controller and all they care is that they they told like what to do and that bike did it and it has a child essay info leaf. That holds the connection.

H

Connections, essay related information, um but you know as you as it everybody in the room probably knows you know, you've got a connection and it's gonna cycle through child assays and stuff like that right, but also um it's also missing the essay information right it has. um My slide is a little bit wrong it it. It also includes not just lifetime values, but it includes the like esp encapsulation type right, like whether there's a nat or udp, uh and a few other things like that. What it doesn't include is the selected transforms right.

H

So you know you might be specifying uh a bunch of different possible um esp algorithms encryption, algorithms, but it doesn't. It doesn't tell you which one it's selected, um also both of the models: don't have any counters. um You know on either it you could so yeah. I think the iclist might have some counters read-only state counters for the lifetime value, but the that information is just that's not uh provided in the um in the child essay info. It you, you can specify the configuration, but it doesn't keep it running account.

H

um These aren't big issues, um but the the sad is kind of a big issue so that go.

H

Let's go to the next slide, so um we can easily modify this model, um but in two ways uh we could move the sad into the common out of the iklis, because, basically just recognizing the fact that you know ipsec's implementations have a sad in a spd, at least logically, whether they're running ike or not, um and if we did that, then under child, let's say info, you could actually then track the sa that the I kid created right. So you would just have a reference to the s say the sab uh likewise.

H

The spd is is similar. That, like creates spds that one's not as big of a deal. I think, but the.

H

Otherwise, you know late in the game: it's pretty easy to change like the module name. So if you noticed earlier the module names for these sdn models, don't include the letters sdn or i2 nsf, right, they just say ipsec, common and ipsec like so. If they're not going to make a few adjustments to be usable as a base model, I think that we should ask them to add sdn to their module name so that they don't look like they're representing like in general, um so the next slide.

H

I got the an example of how to change so the the change that we're talking about here is that iklis basically has an spd and an sad and all we're really talking about is just moving it to the common uh and then the iklis module would just be the notifications.

H

I don't want to get too much into how the sdn model works, but those notifications are critical to running iclicks right. It allows the acquire uh to be sent from the receiving ipsec router to the sdn controller, so those stay the same, but just move just move the state into the common model. So it's shared by the icann dyclis uh next slide. I think there's one other change. So what this means is that in the like, in the existing ike mod model, you just change the hard.

H

You know the embedded values you change them to the green. The reference into the common databases next slide.

H

So if the, if we're able to make those changes, uh then iptfs just augments the common spd entry, and previously we had to do this in two places we, the operational config augments, the one uh sa sa entry um instead of two places and the operational statistics uh modify the sad entry. um This was not available under ike, but now would be so. It would cover both cases and we would continue to augment the uh child essay info, because this would carry aggregate statistics right.

H

So you know the your per essay statistics are are gonna need to be summed up over time um for the connection um next slide? Please so that's it. So the the question that we have for the group is: what should we do, um and I I will note, uh is the shepherd for the uh sdn documents so curious about your opinion. In particular, uh I mean: do we think it's too late, it's a very small change and it and then they would they were actually it's.

H

A lot of work was done in this and it's good work right um and they could easily serve as base models that we could take forward.

H

um There may not be a lot of uh energy in this working group to do yang models right, so uh I I'm just worried that if, if you know we pass up this opportunity to make a couple changes and make them useful in general, do we ever end up you know or what effort is required to replicate this work.

C

Well, yeah, the. On the other hand, the i2nsf working group is does nothing but the end models, and but it's uh doesn't have any more energy for anything.

C

So if you want to make a significant change like that, then it should be either in its last call or even get sent back to the working group to make the change.

C

And I would guess that the right thing to do is to uh talk to the authors and see, if they're open, to uh add the sad to the commoner for in their document and yeah.

H

They seem not receptive to that, um and I understand why right they've pushed through to a certain part of the process.

H

Maybe you know I I mean it, but the the one thing that that's different, I guess here is that is that this is the working group that actually understands the change right. The conceptual change that moving the sad from an iklis into the common, really isn't a big change right, you're, just you're moving what module it's under and the only thing we're really logically saying is that all ipsec has a sad versus just iklas right right, but for the.

C

For the use case, that interests, itunes, f or a central uh controller uh configuring a lot of um like or ipsec gateways, and they don't really need it so.

A

My understanding is that what they are, what they are proposed, what they are actually defining is what how to configure stuff.

A

So in it because it's in eye class, they can configure it if it's an eye common they're gonna. They are only configuring when they are in the icloud mode, when they are running with the ike type, will fill it in.

A

So it's because of this that they actually want to keep that they probably want to keep it in where they, where they have now it's so it's clear for them that they only fill it in and use that to configure ipsec when they are in the eye class mode and if it's in there, yes, both of them have of course uh essays, but when you are using ike to configure the essays or create the essays, you are not supposed to write the young model stuff and and create the essays yourself.

A

But when you are in eye class, you do that right.

F

So because it's really configuration.

A

Not you know, reading information about the you know what like stuff has.

H

Correct so I I'm on a yang doctor too, so the the problem is that that's not actually what yang is gonna do and that's not what they're specifying right, um because we have something called ndma models anyway. The point is when you configure something it's also operational state. So you know just saying that yeah, you know they're saying that like yeah, we just want to configure ike right, but um you know not not having it.

H

Just because you didn't model, it doesn't mean the information isn't there and the other thing is that you they they could easily say. Okay, you cannot configure an s, a static sa if you're running an ike mode, but these are like yang isms and you know I'm not. I I'm not sure if we can make the change, but I also think that maybe we can you know I don't know if we can get some yang experts to say hey, you can make this change.

H

You don't really need to send this back through an entire working group process. Again right I mean that that's kind of what I was hoping I I wouldn't want them to have to kick this back and run the process all over again. I I, I think that you know the the reason to make. The change is that, as you might have seen, with yang versioning, it's it's it's that it's not backwards compatible. So if we ever want to reuse this, we can't right. We have to issue a totally new model.

H

That's the reason I say: if we can't make the change, they need to change the module names, because it's misrepresenting that you know we wouldn't be. What would we call it? Ipsec real, like yeah,.

C

They're fine, with adding ai to nsf to their model name.

H

Yeah that well right, I think that that's the backup solution and then I guess we as a working group, copy their work and move the sad make the one change.

A

I I I would really like to have you know one young model that would actually cover that, because the reason why we didn't do it in a in episodic me because we didn't have people who would actually be willing to write young models and actually know enough for that. So if you know and can do.

B

That and help them to make it make.

A

That young world be more useful. I would be very happy about that, and you know I don't care if it comes from, uh I do nfs or if it comes for ips a kma, but if it's a, if it's, if it's useful for more purposes, I think it would be very useful to have that kind of thing.

H

A

H

We are completely willing to help on that work. uh We would really want to be using the work they did, though, right and not starting afresh, so that I mean that's just that's. Why we're bringing this up is. It just seems like such a waste. You know to to waste all the effort to you know, re-run the entire process for something they've already done, but maybe that's what we have to do and we just copy their exact modules.

H

The problem is, when you think about this from an operator standpoint having two different mod modules that are almost identical, but aren't right, it's just it's just for operators. This is not friendly, um for you know, ietf process, maybe it's friendly and maybe for vendors, that's friendly, who only want to do like an iot device or something, but you know for for operators that are actually running this stuff. It's not from to have multiple modules that are almost identical.

D

H

I think that's over time.

D

um Yes has been to no, we had a little discussion in the jabber that uh the iq and sf document may benefit from having a yang doctor review. At this point, and depending on how that comes back, they may need to make significant changes anyway.

C

Perhaps uh ben it's already had the young doctor's review.

D

For which revision yeah.

C

Yeah, I think even the last one.

D

Oh okay, I was just relaying from the jabra. I didn't actually check myself and there was also some discussion about whether the current version is actually n, dma, compliant or.

H

Not lose the lose the chair of that mod he's in the queue.

H

K

uh I I wasn't going to get there, but it is um the the data tracker's page says that it was had a yang doctor early review, not a final review and it's not an early version and that um that one of the comments in there from martin did the review. I think it's comment because we didn't follow the guidelines for yang models. One of the things that will happen is it does. That is it'll, make sure to address all the nmda issues.

K

um uh Hey chris. That's if you're yang doctor do you want to review you know I.

A

Think I should recluse.

K

Myself, recuse myself yeah, but according to the data tracker, it needs another review. um Just you know again, just particularly because the results of the early review was that the model wasn't ready.

K

So you know, I think you got to pick you're going to have to clean up that state as it goes through the isg processing.

C

Okay, so I don't have a problem with christine doing the review um yeah, so we've got another one in the queue uh valerie.

F

Well, uh I'd like to draw an attention to git to drop and the written job had received quite a lot of changes and it could well creation with uh well. uh We decided with discussion with brian that time we decided to make it more along the like view and not another protocol. So now it is more an extension, a large extension from the ancients.

F

So we tried to keep it as much like a huge football and the results, a lot of changes, and I encourage people to review it to read and review, because the graph is huge and it's difficult to without any review it's difficult to make it right.

F

And another point: I think that dropped intermediate uh exchange is very long for it's about one year without any changes, and I think that the people people has implemented it. So it's probably it's close to uh working group last goal, and so people.

E

F

Both things that you need more reviewing, then please review, but otherwise I think that it's very close to looking group platform. Thank you.

C

Okay, um any other business.

C

B

Hi, uh so just quick um one comment on labeled ipsec: um we are still working on implementing it, um so definitely there's still interest, um we just didn't get to it, um and then there there's also the graveyard draft, which we haven't really talked about. Much um hasn't seen that many changes the changes that people requested were put in. So this is a question to the chairs about what to do with it. Are we going for adoption? Are we going to drop it.

A

Let's try to remember if the graveyard craft is in the retarter, but it isn't. If I remember correctly uh but- and I think.

A

It would be good idea to probably continue working on that, because I think it would be useful to have a document to say something about that, but uh there's also a couple of other, and we have. We know that there's a couple of drafts that are ready for the lasting last call right. A very good last call that we should be starting to get out, and uh so I think we need to take this all over to the list.

A

So if people would uh set the lim uh reminders to the list and saying that okay, these documents are ready and should be going to the working club last call, so we can start it and for the graveyard document. I think you should talk with ad first and you know discuss uh whether he wants to, but whether he digs it it's actually better to have it. That's a as you know, 80 sponsored or on working group document, because I think the problem with working group document is always a little bit.

A

You know slower process and we are just you moving obsolete documents to more historic and so on. It's a little bit more. We have. We have say that we are not. We aren't doing anything for right version. One in the american group.

A

So so, if you have any other business, I think you should take them to the iraqi group list and I think- uh and I think it would be very.

B

Useful to have.

A

So so I think it would be also very good to have you know, interrupt or inter meeting about the esp stuff, because I think there is going to be lots of discussion about that. But it's it was. I realized that it's going to be taking about an hour or so to discuss that. So that's why I think it we got it short here and I think it would be better to have a inter meeting somewhere to discuss only that or something like that today was just the pitch medium.

A

C

Okay, so we've got a bunch of things to do so um with that, I think I can click the terminate meeting button or just wait for mitako to shut us down in five minutes.

C

Okay, thank you all and I think we're done here.

K

K

K