Internet Engineering Task Force 98, 29 Mar 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF98-IPSECME-20170329-1300

Description

IPSECME meeting session at IETF98
2017/03/29 1300

A

For reasons I never understand and the reason I think it using Greek.

A

Remembering my enemies, r and s possible litigation that it without making.

B

This relationship, like joy,.

C

Okay, let's start, then the should be already going around, and this is that this ipsec Amy rocky group meeting and if people are still talking they're, going to be minutes, takers, Oh Michaels, will entail and right yeah wait. So this happy second, even working group I'm take one of the chairs that up giving in this.

D

C

Wall Trier next are to have larger slice. Ok, this is the note. Well I, guess all you will note it already. So next one so we have. The blue seats are actually one blue sheet, calling around they'd put the other one with the shirts. So few of us here and tell you like it. No takers and my clothes already saying yes right, the note-taker, how it could anybody else want to help Michael it all right, good, okay, then I think we already have a chopper scribe: okay, okay, all right! So next one!

C

So so these are our chinta I had with modified it, since they I posted his first time. There's got to be a little more discussed about the algorithm documents and there's going to be perhaps the minimal ESP stuff in the end, depending if you have time- and we should have- because we have half an hour more time- demurrer origionally supposed to have any comments or changes or something that any other items people want to put in the end.

C

Okay. So let's go forward so these the finished and almost ready drafts.

C

Actually, it's very hard to see anything here yeah, so we have published two RFC's in our you know, charter list and we have to approve by ist no that are going, monitor, teen, implement algorithm struts, but there's some issues that man that's going to be later in draft, and then we have one crafty, TCP and cups that is now in a ATF at last call and also and tell us, atoms book tells us move to build for further away even 80 notice that he actually forgot to put it in Alaska.

C

Okay, go to the next slide, all right, so I question to monitor, implement algorithmic. There is no issues in ganar door of the ER. There was some minor needs, insecure and the IST was actually reading relevant because they notice that there is an inconsistency there. It says the triple disease. The text says it should not and the table same a and I think they may is actually the correct one.

C

This is, it has been may originally that the should not text was editor in the way back there in a text, and we test I think it was because you know we added get the same text today. You know other document at the same time and it is suit not in in for ipsec the ESP, because there is a problem with the IV's which I question too. It doesn't matter whenever condition that much data editor the good bit short.

C

You know blockcount actually matters, so we actually can keep it as a may here and that reasonably I think values. Okay is because it was the mandatory implement before that, so moving it from monitor to implement too much, they should notice actually something that this bit to trouble. There is no reason to be anything of them. So if anybody has any comments on this.

E

Marcus Marcus I'm I do because I learned our very valuable lesson. Never.

F

E

Text slides to the chair because he will modify it. Yes, I.

G

E

Add a few more issues: I dare.

G

On the next page, oh, this is the page 10.

E

Okay pause: it alright.

C

So, okay go to the next slide. Okay, these are new issues and I removed one of those, your new issues, because I don't think it's nice and there was also text about saying. Cha-Cha 20 isn't ensued, but it's not enough for should plus at that divorce. um No I have said an email about that, but anyway, so you have some inconsistencies there. That sucks, I think, are all of them. Are international I think there are supposed to be this, but we can actually talk about those. So, first of all is this ecdsa.

C

It text says that they're expect to be downgraded, but they still suit and it's not suit. My nose and I think that's actually is correct, but it's something that we say. Yes, we are going to be in the future. We are going to be a grainy, but you are not wrong creamy that yet because we don't know what is going to be going happen with them, and that's that's, of course, one of the things we can discuss, but but I so.

E

Maybe if you all- and maybe if you go back to the introduction of the draft where we explain what should minus means, it means that we think this will be done in the future. Yeah.

H

I know I know excellent.

E

Candidate for shoot-.

I

Your what why do we expect um ecdsa to become sound good, I.

C

I think I think the current I think the current view is that there is no there's, no hash negotiation there and the other thing is that people are. If everything goes fine and we start using EDD SI, then we are going to be their abilities, but if we don't move to the ecd EDD SI tell me I'm. Actually, sorry! Next, if you don't move to do know the curve top photo 593, not EDD SI, but there you know safe curves, then the enemy.

G

I

But not the signature, it sounds.

C

Very speculative yeah.

I

That's why I think every using EDSA for certificates now at.

C

I

Don't see any statement for any CS that they're going to eat this actually.

C

This is this, is this is easy, the other catching it on ecdsa. Yes, sir yeah yeah, so so so that's why I've actually think that they should be still okay because I we don't have a you know what this code to be replacing it. Didn't we don't see what is going to be replaced, but we can- and we can see that there's people saying that these are not so good.

C

We should move it move away from that and that's why I think they might be going down and I think that text is very vague about this. It's a say: every might be saying this going down in some ways or might not know you.

I

Think might happen. The next signature algorithm that we actually use might be some people scranton. Then maybe it's only coming in 20 years- and this is very speculative- that.

C

That's why I think this will be still okay, okay,.

J

Right, I'm, fine with either should we perhaps rather than I, should look at the text again. The rather than saying just expected downgrade. Should we mentioned specifically what we think is replacing like we mentioned. If EDD sa is being used, if the safe curves are being used, that's likely path is.

C

Maybe would be the working class go yes if we would be in a working group. Last call. Yes, we would modify that, but many of you are pasta. Tell us what I used to have to approve it. I don't want to do any extra. You know the text changes that are not mandatory. You know you're not really needed they. You know. The Triple S is clearly inconsistent in the document.

C

This is it it's us we are saying sued and let me say that, yes, this might go down it, but it's not in a day and then, for example, for the next one, the digital signatures it says, expect to be promoters promoted in the future from suits to shoot, plus or subtract. That reason why it's not suit plus now is that we don't have enough implementations to actually see if it's it's going to be gaining. You know it updates. It's the same thing with the shot chart 20 it's it.

C

Should it's not suit, plus, even if you actually think that if everything goes fine and everybody implemented, it's going to be next mandatory implement algorithmic. But you know before we see at least one implementation, we we are not going to be okay, so to.

J

Your comment before about you know, if safe curve, that's mainly just waiting for implementations, yeah.

C

I think tomorrow most of these are acts. Are you know, seeing what happens with the other things, so I actually don't want to put in any. You know: go porns, oh actually,.

E

The text for just as it is too new for shoot, and so.

C

The new glasses so.

E

C

Need to shoot plus there's a plus in food and.

E

Not in my note here, but I will double check, I think I was checking that.

C

At this time of writing, there is not enough I cross int'l implemented supporting charter 22 be able to introduce a suit blasts level.

C

That's why I remove it there, because I think it's it's clear why it's personal doctor should pass here. Would.

K

You from nokia, so one color regarding the digital signature regard the implications are now so should you be v13, I think they just clarify their text in the standard to use digital signature instead of oldies EDSA education. So it will push wonders all this more advanced, wonder that.

C

That's right, that's why it should show the meaning that the s you should implement it and it most likely might be it might be the marsh mandatory implement argument all then we call the ad DSA I'm, not sure. That's actually one of the things I'm, not sure cool. This one is going to be the next to mandatory, implement our business. Edd essay or you know the digital signatures right in just.

J

To that point internally, yet we've implemented now pdvsa and digital signatures at the curves and chacha poly. So we will get sting. Things are coming down by one. Yes,.

C

J

C

And the last one I terrorist is ecdsa which saw 256 I, don't know why you work so saying it should be, should plus I think it's actually should be should still up. You know.

C

Okay, so so my guess is that I.

C

Think the only change my take is that the only change we actually do is the triple-s and a polio. Are you agreeing on that?

C

Okay, if people agree on that and that denied exactly just these are just something text at web and if it would be last call yes, we could actually text and think about this, but when we are this far far away- and we hopefully are going to be issuing this- you know as a new proposed algorithms or monitoring rambro algorithms faster than you know what it's ten years, that they take it for the last time. So hopefully the you know in five years or three years we actually, but we come back to this. Oh so.

E

Should I push this change out? That which is that about? Yes,.

C

Triple-S I'll and a digital had some neat yeah.

E

C

No, the ASD is already it's already past is T, so I think you're gonna make a diversion of the raft and ask if it's ice from the ice tea. If it's okay, if the macys you did, are solving their issues. Okay, okay,.

D

Yeah and there's a bunch of nits from from from benoit from the gen art review and prevent Campbell's comments. I think that also need to be addressed.

E

Those are already done in a draft like I have a trap for me. Ok, so those are old address.

D

When do you plan to post it after.

E

The meeting awesome or if it's really boring during the meeting.

A

C

Let's go, the next issue is said: ESP algorithm, so there is also same things. You know we have some reviews, nothing stuff, some minor needs and so on. But this is the issues in from the is T. So diversity is that is obsoletes. The cemetery to one in cryptographic, communists only and I think agree that the cryptographic is completely obsolete. Where there are a mix of trucks, remove it appear, so they are happy. Then the Manoir Keating is something that actually needs to be having some texted. That actually is.

C

The current text is they're, saying that, okay, if you use bonded manual keys, you must use a yes CBC mode and I think that section of us a little bit. It is just trying to say that okay, that's value it's Monday through tu no use, but but the pundit reduce that monitor tune. You know, implement it's not supposed to do its monetary use, so that's actually something that we need to fix, and it there is also.

C

You know text saying that you must not use a SD GM and any of these size ciphers that are not safe without the reef. The nonzero keys are saying yeah.

E

Oh I'm, not sure if this works I don't hear it hello, it.

C

Is you had you need.

E

To be very close to a target, all he did yes, okay here we go um so yeah I already have to effect on and you're right. Basically, we just concluded at CBC was the only one you could use so we set must, but we should really say these. These alligator cannot use because of manual keating and guaranteed counters and ID's. You cannot use these algorithms, so if you've I have texted.

C

To flip it around yeah, but actually I, don't know what would be the difference between the Blowfish ESP or you know: ASC, pcs, prophecy, ABC or ASC busy yeah, but anyway anyway meet me yeah, yeah yeah, but anyway. So I would. I would say that you know the monetary monarchies visit uni and we should actually not say any, but you squeezed oj implementations. That's what other thing.

L

Micah richards, and so what I heard you say is that this document will be updated, such that it will say the following: algorithms can or should be used. The following algorithms should not be used and anything not in this list as a may is that what I heard you say not.

C

Actually, we are currently saying that maniwaki should not say I think that that actually.

L

Something you actually going.

C

To another category.

L

C

You might say for manual King in managing in general and should not be used ever and if you are actually I, think it actually is, must not be say.

L

C

L

You're stupid enough to use manual keying, um then the following things are really bad ideas, so don't use them and if that list, if you the end of the list of safe algorithms, is empty at the end of that effort, that's okay!

L

C

Currently, it says that the monarchy is is not to be used, as is inherited dangerous and I. Think the axe actually say. Let's talk about you and I think that actually is good for single use, because actually there is people are going to be implementing man. Work is anyway because it's some cases useful for debugging and so on, and you know testing type of thing. So I don't know two people to say that. Ok, you are, you are not confirmed confirming too, you know this RFC.

C

If you happened to implement man working and it's actually sometimes people actually use it to plug into different key marysville protocols, but anyway, so so I think it's very such a that it should use. It should not be used to it's correct there, but then it we know which algorithm is actually very difficult. I think we actually. This is something that we can solve here. I think we actually should come to back to the list and talk about having textin in front of it right. I, just.

M

Recalled one question and going down and would like to ask the working group to see if it would be a good choice. um We've been thinking about duplicating chippa desk and we know that there are some places is still being used and we wonder if, if we do gasps, would anybody having a hot burn for that policy option now.

C

We already say for ESP it should not and for I question two is going to be May, so we don't care if you deprecated it at me, people can actually remove it if they duplicate means like no use. That's that's fine for us that have you already say it's made major implementing Iike first one and it should not be used in should not in and I in ESP. So, okay.

M

C

If you have done that before we recorded a must not.

M

Okay, okay sounds good huh all.

N

Right. Thank you.

O

So Danielle I think. The reason we said must not for the manual king is not only it's a bad idea, but only one of the streets in is mentioning. Yet you must not, but the other. The other two suites are not so clear about the most nuts sir, so I think in DCM I think that's the same but I'm saying GG.

C

M8 and for Paula tata tata, 20 are or actually any of the counter mode. Ciphers are inherently dangerous with you know, man work is because in man, work is actually means that you type in the case interconnect file and when you reboot, you started sequence number from you know from the strats, and you actually have you know, but a strictly everyone.

O

See must not the.

C

Exit is so if there're several make our creams that can be used with it, but all the cbc modes are somewhat safe with manual keys, but you know, I think the current director was supposed to say that if you, if you are implementing C Mon rocky and you are using you're using it against our best, you know practically no advice use at least the ASC be seen and not flow fleece or something else so.

K

What Mary, King I think beside the testing and debugging poppers lectures as a realist case, which is in using the OS ppl spp of p3 authentication, which relate to use it for the multicast colors view package, melon, multicast, packets and there's no Kurds, there's no practical way to do any any anything. Otherwise beside emoji, a many p, but that's a real use case. I, don't think we should say we must not use money pit, because this really skeezer.

E

The soap opera does I'll answer that in two or three years there will not be any algorithms left for you to use with manual keying securely, so you're gonna have to face that change anyway. um I just want to say, um since this document is about updating, Ike algorithms, this whole.

C

E

C

E

C

Alright, so there's a couple of other suitors this out null and out non non toxic, no and out none. There is some text about. We have talked about the Nala. You know how dedication when we are supposed to be out soon on and so on. Others monsters text about. We change it in a renaming summer girl, because we are now using today, algorithms as they are in our registry, at the cemetery to one actually use them. You know in the clerk.

C

Some kind of you know formula to serve about the same that iono, but not the same. So these are something that I think we are already. You have some of these already in there. So these are the changes. I wouldn't be doing, but I, so the Mon working text. We come back to the mailing list about having some paragraph there. It's one per ography I'll, go to the free thing and and I think molded. Others are fine. Okay,.

E

And then the last one I'm not sure if it's needed, but we came back from ISD refute- is that they wanted some more explicit entry. That said that anything not listed may be used and I think we, we sort of argue that we've already explained this in the introduction or the abstract, and we don't need it again.

C

Jackson I don't know how to resolve that issue. You can just say that they point them to put those two out them. So I think that should be no. You.

E

Have a soda, no I will not make any changes. Yeah.

C

Yeah yeah I see all of these are actually comments.

C

All right next, one in EDSA, so actually now so this is the we have a big group last call done, and there was this question about to be used 0 or should we use something else for identity and I? Think the most people in the listing to be favoring of using new number and I just wanted to see? If there's anybody here actually want to stop using JIRA instead of don't see anybody or you have a comment.

P

Comment about the EDSA I lack, if you curve in casa, but are too concerned about it, EDSA on the way to push it first is not certified agreed or something about official Authority about crypto, which can be a problem on second, which more comment for me: there is no idts occurred available in openness, openssl or GCS. 11 is awesome.

P

Yes, 11 people here, so so as an imprimatur I can't write a code supporting a dds day today on the visit so I'm afraid to push today dds a it's a conveyor hunter quality at switch real shame, because it's a nice thing.

I

You have no well, we have to have standard both here and in TLS that are specifying the use of EDSA before it's worth opens. It sells well to actually implement it, and I have heard from riches nothing but that they are working on it. They plan for some next release, that's coming out next year, I think so it will be. A thing thing is the algorithm that we're using in Ike is a generally decided by the certificate that we're using and as long as the major ca's are issuing only our essay or ecdsa.

I

That's what we're going to use but we're making these documents in expectation that at some point we will be able to use EDD essay and open. The cell code is coming. There's many other libraries that already have such code. So I don't see that as a problem. As for the identifier for the hash, well, zero is already called none. It's no hash is sort of sounds like it, but I'll, because some people might use zero for special value than it's fine, to use a the next available number and.

C

If I understand correctly, the 01 version actually already removed the text about the cheer, oh yeah, so we actually cook we're ready to go forward out. Tommy.

J

Probably Apple so just I mean to the point of: is it ready? Should we do it? Sadly, our implementation isn't open, but we have implemented EDSA and Ike. It's working, it's good. We definitely want to move ahead with it, so I don't want to hold it up for any reason internally right now we're using five, because that's the next number we haven't deployed that yet, but it'd be great to get number five out there. So we don't do bad things to get number five out. The outers.

C

Need to make- and you know, request from iono it's expert review as the document register, which means that when you make the read number for a requester iono, I never said it to me and I will lucky the number we could talk to. Do you explain? No, no, you have to go through. Iono expert can't give the numbers directly so.

J

I mean I, guess, do we want we want to hum on the number and just I got.

C

Six because nobody said anything about the chi-rho expert and he would say yes, okay, so I think. Actually we are going to be with the five and that the current text in the document is okay, so I think activation after this document. We should start. Actually we have done the last call, but so we should actually make you know start the publication requested for this. So.

I

One more thing: curly said that they might replace the oid and then we would have to issue a new draft with the new ID but they're. Finally, they decided to stay with the old oid, so Texas, fine as it is.

C

Yeah they've they've rolled back, so it's it because they said okay yeah for New York. Is we actually going to be audible for the old already assigned or you can use the master there so no issue there? Alright! So next, okay, split dns.

C

You have a which version you have. Actually you have told person yeah, yes, I thought this.

D

C

Oh yeah access. Your next slide. I didn't remove that alright. So now energy who wants to talk about this hola muchacha who's going to talk about the ball, won't have this text the for the slides. You have never seen before.

E

uh Artists, microphones, much better, ok, so we've removed the request, limited domain, so the client could send the list of domains. It only was interested in and we talked about this and we've removed that feature. The sidh every internal dns domain option for the sender is Sarah sighs. We added some local policy clarifications and we've removed the requirement for the childís rate to be up for any dns IP addresses that percent.

E

So previously we said, if you send an IP address than one two three as a dns name server for one of the domains, then you must make sure that there's a child I say up for that appear, dress and after talking previously in a working group, was decided to remove that. So those are the issues we changed. The last version that was like the 00 document after adoption, so the open issues are there's two items aware we had consensus about.

E

Changing is CFG request, see if she reply in the attribute where we decided that you could only reply to them when you saw them and it was sort of based more on the IP one model and the iclear took or RC actually says that you can send these things optionally and you should be able to ignore them.

E

So we still need to make those changes with those changes will be made and then the only real open issue is the issue on the dns and what to do on the VPN, disconnect or reconnect, whereas specifically, terror me have quite different opinions on what to do with the cache entries.

E

So my opinion is the case where, if I connect to read calm- and I want to talk to bugzilla, overcame I'm getting the internal IP address and if I cash that and if then disconnect my VPN, then I need to go back to the public IP address of the server. So I need to flush my cash and so for me, it's important that that that's in the protocol, it says you know flush the cache for these entries. If you reconnected or disconnect your domain, anantara has a different opinion on that.

C

Document inside secure, so I think it's actually it's something I don't want to be late there. You know cash interest immediately. When you have you know a child SI going down or like I said you're going down, but I mean that would actually you know course troubles if you have it, because what you usually do you just recreate it immediately, but if you tear down and then you have, you know, love your connection, sir. You know failing because the dns name isn't funny. That's actually not very funny.

C

When you have you know: 10,000 you know-- tabs open so choppy their own names that then you suddenly have them. You know I.

E

Agree, but in in my view you just have not turned on the connection yet so you're welcome to use your old cash yeah.

C

But your text say so, then it goes down we'll remove the cash enters immediately.

C

You must remove them. Yeah.

E

That's do the question well,.

Q

Actually likely.

C

To it's the same right.

E

Because if you, if you killed I, to need the child.

C

Also tied is not the issue Chinese my face. It's like I, say: calm down, Mike all right, Mike.

R

D

Have Mike Klis sorry.

I

If you don't flush the cache that mean it's not home, if.

F

You don't flush.

I

The cache, then you end up with entries for non routable IP addresses and that's not going to work anywhere.

C

No, that's what that's the idea when you have a non-routable address, you see what happens there. Then, when you send the traffic it will drinker type a sec to create it again and then you have it back. That's that's the basic idea, because I mean you have that you have the treatment rules that are still.

L

C

Richardson so.

L

So I think that that the Paul's use case, where you have a different I, a record or quite a record for an internal versus external I, think that's maybe fundamentally broken arm. So I think that but I realize it's done all the time. I think it's fundamentally broken.

L

I think that you should have either two different names or something that that that, because if there is some risk of disclosing traffic- and you would go publicly if the link was down, then obviously there's no risk of disclosing traffic right, because you would be happy to do it in the clear then you should just do what who cares? Do it in the clear or whenever it changes, doing. Look here, clear or whatever, but Tarot's use case, I think, is that you know you have a bunch of these internal things that you want to.

L

You want to reach again, um so you know close your laptop. You move, addresses your IQ sex die, you bring it up and hit reload. You expect it to work and to do anything else, so he's inviting users to get confused so.

E

That would be based on the TTL of those dns records in your cash. That is really sketchy, so you'll end up like with half the time it not working anyway, because did dns record happen to expire and you're just typing in names that aren't part of the public's. Actually you don't know if you'll get the internal dress or an.

L

Rn annex domain, one of the reasons why I think the split dns is fundamentally broken actually, but but assuming that that you've pinned some things to have some domains be internal okay, that should not expire, even if the TTL of the rest, so you've just said, I've got some configuration that means domains. I look up internally through this. These other places that stuff should probably have its own TTL.

L

Does it I, don't know I haven't read the documents detail to know that and that should persist, persist for a period of time and I think that period of time is potentially very long, but but.

E

Then you've got this really inconsistent results, as if you put your laptop with a zero cash and you're trying to reach this internal resource, it's not going to trigger any VPN, because I know and.

L

So so that's that's part of the question that I have and I think that's fundamentally broken and I think that we have better solutions in DNS that most people and live in a v4 only world. Don't understand that that would permit this to work very well. That's right! So so I realize you guys live in this real world of administrators that think they own ten net and there's only one ten net and they only have one VPN up right.

L

So I know that I know that those those people I mean I, think they're idiots but and we're supposed to help them out right. So I'm saying: if we're going to help them out, then we need to. We need to have that some kind of pinning so so that those things have to have a time to live and every time you bring up your VPN, then I think you get essentially new records and new ttls and everything's good right. I.

L

Think you can make that work, but I, don't think you want to flush the cache when that, when connections go down, that's what I'm trying to say right or if you do- maybe your Paul's right. Maybe you want to flush at every single time because you want to do it, make a consistent experience, which is that the user learns?

L

The names will never work unless he clicks on his VPN button, even if he just moved from this room to the next room and closes lid temporary temporarily, he knows he has to hit the VPN button and get out his card, maybe in whatever right.

E

Why does your VPN die when you suspend your laptop, but that's.

L

E

R

Times more than I've been my.

L

Laptop because I wind up on weird networks of hotel or something I, don't know.

J

Tommy Polly Apple.

D

J

I mean I think dude. The kind of the real world perspective. That's driving this I I think we need to leave in something about flushing the cash I'm, fine, softening it and saying like, depending on what your implementation does. You may flush the cache or, if you expect these DNS names to be truly global and managed correctly, and you don't have a broken split, dns configuration or your enterprise, then you cannot flush it. I think we can just iterate that I don't think it needs to be solved in this document.

J

This doesn't need to solve the world's problems on split dns to the point of triggering, so I may, at least on our end, we're not going to trigger based on the address once the VPN has gone down. Oftentimes oh I mean what solutions to do now is that they trigger, based on the fact that the host name cannot be resolved anymore, and so, rather than treating us an address you trigger, based on something about the name of the DNS failing, and you realize that oh dang, it I got screwed up.

L

J

Yes, it's a known, p name, so there are other ways to solve this, so I don't think we need to iterate them all. Here we can soften language and just kind of move on, but.

E

But will the softening of the language cost center probability or expectation problems later on, because we already have four different expectations in this room? So.

J

Does the I don't know if the expectations really matter all that much because it's really just a local client policy about what it does so? I me to the point of where we've gone in the draft of saying that you know the client is no longer specifying to the server here's, the ones that I'm willing to accept. Essentially the clients already potentially trimming down the list of domains. That's going to be doing split DNS for it's making its own local policy decisions.

J

It can also make its own local policy decision about how it treats the cash yeah.

B

That is consistent. That I agree.

R

Yeah Kyle Bekker, its Facebook um I, have seen some issues where people want to. Basically when you're on VPN redirect people on that VPN to say some like release candidate version of your website um and then, if you're, on not against public internet, go to a different site and then the release candidate for sending for whatever it's only available on to VPN, and that does end up in shoo when you disconnect from VPN, but still at the cast entry for some IPS.

R

Only internally route of all so I do think this is an issue for smoking is released.

C

Their community I think I think it's actually.

C

You know, as I said, you're thirsty, I, don't think this actually interpreting seal because its eternal of the machine anyway, so your expectations is going to be same when it's your machine and my expectation going to be the same for my machine and it's going to be same for my machine all the time because I'm losing the one implementation I'm not going to be switching from desert a doctor, but I very private suites, I, probably hope for that they potentially go either to the same or better and and then I actually get CS it.

C

But the current takes to say that you have you, must you know first plastic ashes and that's the most is what I've? Actually you know say you could say that, yes, you you should be. You know you should remove the cash she immediately. Many you know fear that you are not going to get be in the VPN anymore. That would be actually much better decks or stuff like that. But I think we got it from back to the least, and you know it discussion there and go. Oh.

E

C

E

An inside I think people agree that it that we can relax the master, so the question just becomes: are we just going to relax the must and leave the data? Are we going to actually put some of this discussion into the document.

I

I, don't remember from the document: do you also flush the car, the cash when you're, connecting or only correct.

E

Well so actually took affair. My implementation does that what at the draft says it I, don't know all right.

C

Okay, so so they come back to the list of this issue and I think actually it's most of it to the routers to actually decide what taxable to put their oddity. You know you can propose some text and the working group will disagree with you or or agree with you.

C

Ok. The next presentation, I think, is the first quantum shirt case that you had a appreciate. Keystroke.

S

C

C

Even if you, even if you can't see the slides but they're, still be visible from the air.

S

I should hopefully go ok. This is both con crypto I, I I'd be too next slide. This is a next slide. A brief summary um right now, with the kekeke. That's pretty. uh We depend on diffie-hellman occurred for Helmand for our protection, a sullen stores tend traffic for ten years, the bill on computer. They can then go back and read all their craft, that traffic um that's a good thing next slide, um and what we going to do about it that the obvious solution would be to come with a post quantum key.

S

I key exchange a good idea, but there's nothing that we really like right now. This is going to have a comp tech contest, which role might be in seven five or seven years come up with something I don't know. We want to wait that long. So let's come up with temporary solution, but what I'd idea with our strategy here is actually have.

S

Both sites have a shared secret and basically, they stir in the shared secret in when they derive the keys, and so, if someone someone breaks the difficult as long as they can't break that they shared the secret. They still can't be able to redrive the keys and therefore we're safe and the keys need something ridiculous valve entropy, but exactly achievable next slide or sorry. Is that.

P

T

S

What we talked with weed mostly agree about the acquirement such algorithm guild is important. I think I traffic needs be protected. I traffic is less important, but it's that seemed to be a bit debated available. I. Have we have the current draft right here and there's a couple of points to that were brought up on the mailing list and that's go through them next slide.

S

First set open issue was how we stirred the property that the shared secret or what we call PPK the drafters it in to every single child s, a negotiation expansion for uh whenever we are forever uh Valerie Smith I, this loft mmm I, hopefully not butchering that that that too badly suggest adjusted my fine yes TKS KD um and that that's initially one time and then uh there after the death, yours everything is derived from this skd we're all safe one nice thing about that is you don't have to remember which, which preacher key you actually used.

S

The Dan Harkins also put the made a separate proposal about only changing the ipsec keys by vitamin, my only the key that key expansion. uh What I would like to do is somehow come up with a consensus about which of these three approaches or possibly a fourth approach, is what we really want to do.

S

Comments questions is everyone. Anyone awake.

N

Okay, I'm buddy else can talk. I'm, Darryl, Piper I helped design. This message and Arkin's I mean we need to do something about this before nest.

E

N

That's my comp. Okay.

C

Given him I think actually that I have proposed a one-way also earlier very early. That's why I think I think the key Matt only is has the problem that it's a it has the properties. If there's something wrong, if the key Matt, if it's wrong, we don't know this. If it does notice it all the ESP traffic, is you know how much this way I actually want to do something in the ike that we actually notice in the ike that ok there?

C

You know, for example, the authentication fails because they, you know Sergey PPP k is wrong and that's why that's? Why I think that you know the correct solution is to know somewhere in the volta a ski day T which actually desk ed, has a good property at that they, if you because that's used to when you are doing Ricky of the ik, say it's used to create the next keys for their weakest Ricky, so that will offer you after the Ricky you also the ike traffic. Are you know, PPK protected.

S

Here's a suggestion arm. We make it really explicit. uh Basically, we exchange uh notifies after we just create the IKS Isis to negotiate that we actually do want to do. This ah would, if wanna notifies included, say a hash of the tpk. Yes, I would see if it's the wrong hash its notice to notify that immediately and therefore they wouldn't know that gee. That is what specifically is wrong. That.

C

That's one of the problem there is that these actually knows which part of the authentication went from good, then we'll be able to. You know, attack, authentication and the ppk separately, because you get the different error message. If one is wrong and other is and that's why I think that would be better to have.

C

You know just normal equation to authentication failure coming out, even if you have a PPK failure wrong or if you have you know other type of authentication fair, because it still out of the case I felt like because I thought: that's why I think it? Actually it's better to do it that way, it's.

F

Actually gives.

C

You know we don't have to send any extra bits in the you know wire, because we have already. You know we calculate the hash to do thousand occasion hash, and so, if it just put the ppk somewhere in there, we actually get them. You know arrow there, our mom just thinking cry, do.

S

We know that early enough.

S

What do you mean? Because we don't really know the ppk until you've change identities, the VP.

C

Case, the out of the case in hash is calculated in love.

S

Yes, right, okay, so so yeah. That sounds like a resort, proto and.

C

I'd, actually is one of the things that, because the other negation hash is calculated using one of these s key, actually it's be a and B are so.

F

They actually feed us to the ppk.

C

In SKT and escape ER and pei, then they actually get this problem.

L

Michael Richardson so um and I agree very strong with taro and I and I agree that I think my lean, pork, whatever we do it's locally la ghable as to which was actually failed, so that local administrator can actually see what did I screw up. uh But.

S

That's exactly what a taro was suggesting and that not happened. Yes, no.

L

S

He's saying the opposite:.

L

The remote guy doesn't know which one I was wrong. Okay, local guy knows what's wrong, so can't just be opaque. Oops, you know stuff went wrong all right, not that's! What happened in Mike will be one with various things originally with with pre shared secret keys. If you got the wrong you just just couldn't decrypt stuff and didn't really know, what's going on the right, we're a lot better situation with ip24, a lot of reasons, I think that some people in the list are in the room if they think this through may ask the question.

L

Well, if I have gone to the effort of distributing / Pierre keys PK's, why am I bothering with any other kind of authentication, because that would you know seem to be stronger and I?

L

Think one of the answers is because you know you have other other issues of scaling and other things like this- that you want to do, but I think that the authors in the working group needs to ask the question how to what extent do we think that that we want to encourage and make it easy for people to deploy this kind of thing in advance of this, and I think, there's some serious chicken and egg problems in this process.

L

If we don't think anybody except the super secure people are going to bother to comply it, then it's not going to be on customers, checkbox lists the vendors aren't going to produce it, and the end result is that no one will use it, including the people who you know would like to have more than one supplier for their super secure stuff. So that's an issue right, so if we really wanted to do it and I think we need to make it a little bit issue and I was very surprised.

L

Several people said: oh, my goodness, we don't have to even bother deciding what the format of the ppk is printed and I'm, like. Oh, my goodness, that's like the most basic system in thing, the guy can't type in the ppk cuz his formats different, the other one, and he doesn't know how to use perl unpack on it right, because, just honestly, that's Europe, k, labs, told me: you know that that's the level of administrator we're dealing with.

L

So, if we're not going to make it easy for people to use, then actually my question is: why bother if it's only going to be used by the NSA to secure you know, US government's, you know what they can just go to their two preferred vendors tell them to implement your protocol, maybe you're one of those preferred vendors already and we're done right. We hardly even need a standards, action right Scott you decide what to do. You're done. Let us know informational draft, how it went.

L

Okay if we actually want people to use it, and you can report back in five years as to where this accessible or not right. That will be great, maybe we'll just stamp. It was a great idea. Go ahead right.

L

Right exactly he said, but but at which, at which point will then have a distributed source of ppk.

L

Okay, because that's the point, the point is to get that PP k into that algorithm now such that, in fact, no one on the wire will be able to detect whether app redistributed PP case or I have a proper quantum resistant. He agreement algorithm right or so I quantum. My green book he agreement valid point is that because those PP case can come out of the other thing that you just predicted existing right.

L

Nobody on the wire observing the traffic until whether I have one of them or not, okay or whether I just you know, courier USB keys around or something to do, the right, yeah.

S

Although post quad these post compra Kripke exchanges are pretty large that they tend to be pretty noticeable well,.

L

Iii, amazingly.

T

L

They occur through the subspace Star Trek subspace.

S

L

Know so I'm not worried with that. If.

S

We had some access to subspace, there's a lot easier ways to do things.

C

Yeah better, given it so so yeah I, think I think actually, because that's one of the reasons we want to make it is very easy to implement so that people to be no two or three lines of code. Then people are going to be adding it regardless. If it's you know, if they think it's useful or not it's a it's useful feature. So it's always useful to have a one more feature in your feature list, because that might be something that customers will look and all your competitor doesn't have that.

C

Oh, that's, that's better or at least yeah. He has 73 pay, you know lions and he has 72. So this is better because had one more so that's why I think if people are going to be implementing it, but it's going to be used. That's the next question and one of the things I don't want to be. You know I'd, say I, don't think. Actually we need to specify anything for the ppk format, because it's just random binary or bike club that is going to be feed into their critter and if he is in.

S

Binary or ask you strange, it.

C

Yeah, how do you type in Europe, pre-shared, key pre-shared key- is a binary club, no ascii ascii, usually chaski yeah yeah but I mean, but my format is not saying that he's yeah that that I mean I mean it's good yeah in here we actually more expect it to be binary than string like insert key. It's actually used. Quite often they are. Actually you know.

C

Just you know strings it's something I make me a tasty gold yeah, so so, but with it here, I think the x-ray expert tend to be more like a binary option and one of the things I really like to have it. I would like to what you are saying at me. I need to have something now in a protocol that we can plug in that you know the real team.

C

You know quantum key distribution reckon it's later, so we can actually run that first, then, we get some kind of binary blobs that we can use here and actually I guess it would probably be something that we run it once then they get. You know 10,000 of these binary blobs and when you use these PPK is in you know in some kind of order, and then they have some internal format for the pp.

S

Yeah, actually, I was personally expecting that once we have a post card key agreement, we just slap it in to where the existing DHCC DHS it.

C

Might be there, but actually one of the things is there as it, as I said, is it they're, usually quite large yeah, and you might actually want to run them all over tcp or something like that. Instead of you know, you did leave it to limit that packet sizes, so I think it might be. Actually this kind of free generation, the.

S

Other advantage of that Patera key exchange have that we're at with that. We don't is that those can rerun with before you'd actually know the idea with these peeps case, because you have to know the identity of the pier you, you have there's a chicken at a bit of a chicken egg with the pure post key exchange. There is no not and and.

C

The other thing I was think about here is that in Ike we always assume that the configuration is in both ends you actually. This is actually one difference in, for example, pls. We assume that okay, random machine somewhere can connect to server and they don't they don't share any configuration, accepted root of trusts, but I mean ends it with ssh. For example, you I don't expect to be able to associate from my laptop to your laptop.

C

Usually if I yeah, you don't have the ftp and the public and with Ike is about the same attic in most of the cases we actually have. If we have, if I talk about out, indicates not another motion or opportunistic with all eyes from the community.

C

The comment, if I don't say that, but if you're talking about you know normal, you know authenticated IP secretary, so you are going to be configuring both ends, which means that your, if you are not using some kind of ppk generation from either from you know, you know one time password taking slices of their you're doing that you know in both ends anyway. So that's why I? Don't think we actually need to have any kind of real format for the PDK.

J

Tommy Polly Apple yeah I strongly agree with tear of that I. Think, first of all that the format, even if it is specified, should not be part of this document and hold up this document through from going through because it's important to get the specified. You may be interesting to have a separate one about what are different approaches to sharing PPK, maybe as an informational thing, but yeah. It's probably going to be binary, and there are ways that servers have to distribute shared secrets now and they are different and they're still going to remain.

J

Different people are going to be sharing these in the same way that they're sharing all of their other authentication material.

J

Which is why we should have a separate document, talk about safe ways to share them, but I think that's I! Think let's get this, because this is better than what we have of nothing as.

A

You step one and.

J

Let's, let's write that document parallel, but I don't think they need to be block.

I

You're here and I want to push back on what Tara said. If this is made easy to implement and yeah, it could be three lines of code, but that doesn't really add a feature to my product. If I'm don't solve the key distribution problem, because if we had a good solution for the key distribution problem, we would never reveal certificates for authentication. If I had a hundred gateways and I could just easily distribute the 9900, the pre-shared key is that they need for good authentication. I would never use certificate.

I

Certificates are whole mess of stuff to use. Okay, yeah, okay,.

S

So tickets are crap, okay, I can I then asked for an alternative to this approach, which doesn't involve waiting for the next post. Quantum key exchange.

I

It's a bandaid in there. We should think of better ways to distribute the keys so, but if we have a solution for that, what are we waiting for for the last four years? No I, no, no I.

A

I

I q2 doesn't have doesn't have a support for preciate Keith. We just don't have a distribution, that's probably some something outside of Ike.

U

Dan Harkins so uh like this we've got kind of derailed here up, but as far as distribution of these things, so peak X uh defines a symmetric key package. Now we could it's a nice format to distribute things and if you have mentioned on the list, if you've got armed guards that walk around distributing these things, that's that's probably what you got to do, but I want to get back to the slide. You can let up I, don't actually remember what why I suggested he met the terrorists suggested something else.

U

I didn't understand what he was saying or I, don't want to put the ppk taro so.

C

In I crossing to we have this sk seed, which is going directed by the diffie-hellman output. Then we have this PRF that generates a bunch of this sk, something there's sk d, which is used to derive the derive that you know, keep my carry on sir and there's a I, a and E, and so that's encryption, authenticator and then there's this skp I and PR, which I used to generate the authentication hashes. So there is it's used in. Let me see, do you want? You want to mix the ppk and regeneration of all of those.

C

Only the desk, API and PR that the problem with I cousin one was that it actually gonna use. The search key is to generate the encryption keys. Also they skate you know, II and which means that if there's something wrong with the ppk, it's a skate ramp and traveled.

U

With our big butt, but if, as you remember, that's why it's.

C

Resistant to know yeah, but that, but that was the book that was the problem. Nobody uses it every Busey's addressing mode because of that.

U

Ac to generate the whole string and no.

C

U

No, no, no I want to I.

C

Want to get a right, sk d, & s, kpins kpr, as normally I know not just just like it they're done now, but after that I will fix them every time they are used. I add there at PP k, so you have.

S

C

S

Actually, I generated.

C

Sk sk d, you know kamau something like that and you know we test at pdk and then use that sounds.

U

Like that, but ever doesn't drive SKT normally.

H

U

The ppk post, quantum goo you do skd. ' yes and you'll. Do an sk PIR.

C

' + p, I approach.

D

Tira, would you be willing to post your solution to the.

C

List I think I can try to buy old email from 2012, oh yeah. It might be.

V

Markovski ncsa I thought.

F

V

Said earlier that um you expected that one sir, a nest candidate, algorithm came along for doing the smokey exchange, then you thought that I would just be able to swap in in place of the CDN yeah.

S

Yeah, that's my personal expectation, that's just me, and also it would not probably be not just a lot of self. It might actually be on alongside a key LDC dhcp exchange. So.

V

That was kind of what happens like that. It might not be simplified, but it might need to be in hybrid with a whatever the desk either, because we have, there might be some negotiation parameters required people to start thinking about formats or yeah. What they hear. The protocol cuz look like for the birth yeah mixing in those yeah.

S

But that's a much longer process so.

V

It's by the way, I think it could be starting now developing that framework in advance of having of the list algorithm specified.

H

Philip lafrance I, Sarah, um ok, so it's cotton, I talked with this briefly before so. I think we're all in agreement that we can't wait for this. We should do something now, but this is certainly a band-aid I think we all agree. So um my concern with with this right now is: it doesn't offer any forward secrecy. So I'm, pretty concerned with you, know quantum adversaries so I think forward. Secrecy is a really highly desirable property to have and I think.

H

If we're looking forward on the technologies work, hopefully to roll out eventually, then I think something like that is what we should really keep in the back of our minds and I think you could probably achieve it with some sort of ratcheting protocol like signals, so I just want to just put them the back of everyone's mind. Let it percolate just a little bit that this is something that I think we should really really try to get.

H

N

Well, it is related to that I mean I. Don't agree with that statement that this is a band-aid. This is a possible solution.

H

Brian, wise I, don't really have an opinion and how we should stir in the ppk, but I think there should be a requirement that all the subsequent ike message is not just should be projected. That's PK, not just the ipsec keys, I.

T

Just told you up to the point about Mandy: this is definitely a band-aid as I'm too short, I, guess so the Google's algorithm or whatever. So as the color computing stuff advances the I'm crucial that well, this is I'm just going to coach a mere, but it's going to be quantum algorithm that lets them come out. So it might be good for now, but there are the new algorithms that will for the weekend, the keys. We should.

S

Take that into consideration you're! Finally, here is it right, a wormhole, ah basically free fluid could leave that so another look like a long as you help of mathema of entropy that may be in your PP, hey to be fair. We.

T

Should never say never understand things.

D

So Scott were nearing the end of the original time that we had planned for this, but we still have some time on the agenda, so maybe 10 more minutes.

S

I read that ok, we really don't either we don't eat it or if you go to consider them, then after a football reelabilities.

T

S

Think everyone's okay, with a note, my heart to deflect business yeah.

C

As a chair, I think we need to have a separate document for that and I think. Actually we have to check out the verb we actually make. It need to make it charter change for that, because I did to get second correctly. Our charter to do children's but I think it's actually it's very doable and do it afterwards. Yeah I.

N

Think that's a good way to see.

S

Anymore, yeah sure is make sure that we're not sitting up here exactly where we are o people.

C

To Berlin and roxrite anyways, so yeah so I actually want to get in a new version of the craft and I think. Actually we had a good case Arsenal. If you actually get can get to the you know: agreement with their. You know what the variax are going to feel feeling the ppk I think that they don't get any version out and then it's you know, I think this I have a lot working group last call for the document that well.

N

To trust that I'm Darrell paper again I'll I'll help you write a document if you want, let's bundle all this together,.

N

Can't get this design three months.

U

If you go back a slide, I think I think Michaels got a point here, but I it seems like we don't really need to define how these are distributed. That's out of scope. We just deal with the bits on the wire, but because of that I think we should define some sort of a format like and I suggested. The EP kick symmetric heat format that you have to adjust.

U

One of these blobs to put the ppk into your your I complementation and then how you just hope these blobs get moved around securely is not our problem, but I think we should toss us.

C

Pacific 1500, my gladness official, this a strap or that.

U

Allows for interoperability, because Michael sandwich base64 something like that, so we should just have some well-defined format that sent text to container container of these things that you can do well. The nice thing about about the symmetric key is it you can have a it's like a bag right have a bag of these things. You can. You can protect the bad now protect with what is a problem.

U

You know that sort of like layers of the onion- but you know ingesting one of these things- would be a nice way to load P pk's and hear your IP to employ tation I. Think.

E

Well, I do think it would be good to define some sort of format for representation in ascii, because we've seen some interoperability issues where people put spaces or single quotes in there, and they appreciate key and not all vendors, accept that, and so you got like weird broken vs case, but also don't want binary blobs in my config files. So so some some standard might be nice, but it should be really simple, like indeed like base64 or something yet.

C

We would prophesied that if you, if you use this as a string format, you space 64 all right anything else, all right. Thank you and it's move forward and we have implicit IV and then perhaps a minimal ESP.

W

We have a discrete oh yeah, it's.

R

R

I

Charlie turn it off then, on again, okay. So last time we had three suggestions of how to negotiate it within the essay structures and thing we finally converge on using a new transform IDs for each one of the algorithm. So we have a sec em. Now we're going to have a SCCM, I IV same for GCM same for patent chhatrapati, and it was a question whether we want one for just playing aes counter mode and no everybody thought not okay, so next slide and okay.

I

That was the last thing last time since then, we've talked to occur and he mentioned that. Well, you wondered why we were negotiating like negotiating it like this, because it seemed inefficient and it is inefficient, but all the other options are even even worse because of the way unknown had attributes are handled in the essay payloads so that it's not great, but it's probably better than the other alternatives.

I

Another thing he mentioned is that there is a way to do this with other and Griffin algorithms that are cbc based because so we could have in the key material extract. Yet another key and yet another say AES key then use that for encrypting countries and because we have the same key when both sides, then we get to sing encrypted counter and that can be used as the actual IV for cbc. That does work. We actually considered it at some point, but then we said now we don't really want to do that.

I

Yeah you can you can, then then it started to prove that it's okay.

C

All right there are giving it I think I think the keys ago actually bet best way to do it in with the different ciphers, because one of the things we are here talking about you actually modifying the cipher, because the IV is part of the cipher and you we are removing that. So, if you talk about the crypto context, is there is you know we have a? You know, encryption cook function that gets you know just we call it and we get in.

C

You know encrypted data, and usually the IV is actually inside that script of context. You don't actually, depending on the implementation but agreed.

F

Or appear in this.

C

Case we actually need to make modify that context way that actually how to cryptos call. We have to keep this external sequence number, and actually we have to somehow make sure that the crypto algorithm actually understands, as it actually is getting different. You know Ivy's different values for the crypto sequence. Numbers are separate for our son, so we have. This is like this is why I actually want to do it in it? It's a separate.

C

You know I encryption algorithm so because it's going to have a different type of you know, for example, you can I, don't think. Actually you can actually do with the peeps version of these, because I mean phipps, where I think it actually requires the IV to be part of the no context Iran, and here we actually get it from outside. So so that's why I were to get it might be better to have it this way.

I

So, since I think that nobody really wants to do this for CBC, because nobody really wants CBC going forwards, then I think we can I think the document is good as it is Kathleen.

F

Moriarty responsible ad for this group for few more hours in my point in that, maybe some people might not know who Ecker is not in the room he's in another session. It's eric course korlah he's the incoming sec ad and we shuffle groups I'll be sad to move on, but I will continue to obviously read the drafts in at least by IETF. Last call and I'll be around so.

D

Thank you for all your help with this group.

I

So any Stintz so.

C

As a chair, I have a different question, also how many people have actually read the draft ooh?

C

We actually have more, how many people actually have said comments and reviewed it really. You know only just which I but last time ask because I had problem that it was like one or two and it they were routers. So now we have a much much more. It's actually means that we could actually start going to do home. So.

I

We imagine with Deckard's hearing is raising his hand.

K

You I transfer, IDs I must use the discussion on the list so why? Why is that using powerful new ID? Why don't we just having a new access for attribute to see? You know that.

I

Because the rules for handling and unknown attribute is that you know the entire proposal, so we would so to interoperate, with older implementations would have to send the whole proposed other proposals with the indication and then over again without the indication, because otherwise the proposal is no good. It would it's just inflate the size of the essay failed much more.

K

Reason we have to keep adding these new IDs every.

I

New algorithm needs a new ID I mean if we're.

K

Not we get to I was not.

I

Necessarily at some point, supposing that it becomes widely implemented, then the next algorithm that comes along, we might have only a nun only I in implicitly version of it.

C

Okay, so anything else on this topic not.

I

Shorter than 20 minutes that has allotted yeah.

C

And I think so, as we seem to be having several people reading this document, I think I've actually adjusted and starting working group are absent. Another angle for these, so so we have. You have a couple of weeks time to comment on and very out of it then so that is it good to be adopted as a working group documents and then we hope, look it going forward all right.

C

No, I don't yet.

O

Next version, or no.

C

Actually I Iranians changes. You want to do now. Oh nah,.

C

So if you want to make a new version.

I

G

I

Reference, if we make it, the working group draft in the 00 version can have the reference all.

C

Right, okay, so so so I will make a working group the adaptation call now and starting now and then then it went even it finish. You can actually publisher 00 version of the Republic, but so the next one is to minimally. Yesterday we did have a time for that.

O

So minimal ESP is about providing guidance to have a minimal implementation so to make well to help developers to have that so well. It does not update nor modify the standard ESP next slide. So basically we go to every fields and define while provide some guidance and how to implement them for the SPI. We we recommended implementation generate a random spi, but for some constraint, nodes random generators might be a problem so where, if we have to use one fixed spi, then we recommend to to have well.

O

We would like to mention that. Do you have some limitations you so, and one of the limitation is that you need to be able to identify to to index incoming packets to sa. So what we recommend is, if you choose to limit the number of FSB either available to you, you should be have at least one per session / host you have if you're using the IP addresses one of the question we had is: do you think we should make some recommendation and how to perform the lookup for DSA?

O

So if so well, we would like to ask to we recommend to have a for unicast nodes, a look at the phone on the SPI only and then for all the other nodes using multicast and any cast. You look at IP address and the longest match prefix.

O

So does it sounds renewables to to have this kind of recommendation or out of scope.

U

huh Dsp said that you choose the spy by destination address or you choose the essay by destination, editors in spy and smite.

O

U

Dictate what years with the spy as.

B

U

V

O

So, basically, you have to kind of look up so I'm just wondering if we should have those recommendation into that draft, or currently we just explained the two lookups, but we don't provide recommendation so I think could be fine with that.

O

However, we just have this kind of recommendation it for the fix SPI a little bit more well and well. If you're using a fixed SPI, then of course you get some privacy considerations, because then someone monitoring the network and somehow identify the device or even to yourself. So that's thanks for you commented into the draft well in any case, if you have any comment pleased to provide feedbacks on the mailing list, next slide well, SNP, paiting and net setter. Well, the only thing to mention is that padding is not mandatory.

O

If you use CBC, but then we don't recommend to use CVT so because padding becomes mandatory next slide. So above the crib. Well, I CV is optional, but it depends on the crypto you use and well. We recommend later to have a authenticated encryption. Yeah.

O

S

Letter of your.

D

Name: Scott Scott.

S

Next header, that's also use who'd indicate which packets are a double block, a dummy package well for tsa, pat TFC protection. So can you really get rid of that? Okay,.

C

Yeah it's used, but up of course you know 30 minute, of course. Yes, of course, when I talk about you know, minimum version where you I want to save every single bits. I, don't think you actually look on to Center. No traffic flow confidence of the pockets there, because you.

B

Don't you don't do what.

H

You say because of the extra data and.

C

Actually, one of the things I think I think the next hitter and these kind of things are actually something there's this there's. This beat mode of type of things like wood accent, be also useful in this kind of situation. Where you have this in, but a negotiated I que si. We have, you know all kind of or IP circuits. If you have, you know the source and destination address these port numbers and protocols, and that kind of things already agreed by both ends.

C

If we make it by, you know very specific SI, but they're still sending it in every single pocket, and we always verify that. There's what what is actually supposed to be coming that the diversities you know discuss on I think it was a mechanic understaffed about the beat mode that we actually know, especially going to talk about tunnel McClatchy tunnel mode.

C

You know semantics, but the absolute transport mode, you know type of you know hitters, so the axe, I, don't have an extra IP header inside, because we can reconstruct a in our heavy hitter from day and that actually would be useful here at Celtic also. But it's an idea, XO! You might be talking to think under about taking that raft off right, yeah.

O

It took but um uh well I, don't I wasn't sure that we were to move a debate mode.

C

So so I think actually the xterra, but would be probably be better, so did in that kind of situation. Doesn't he right now? Okay,.

O

But then what should we put as a recommendation? Sir? Okay? So that? But we have to discuss.

Q

Valerie on the and the jammer, if I CV is optional, doesn't it mean that authentication is optional in ESP, but the draft RFC 7321 this mandates? It.

I

Then your question: did you say that padding was optional? Well.

O

What I say is that padding can be performed by the encryption algorithm or the ESP? Ok, so you have to wait to do the padding. So if you have only if you have a small implementation and using an algorithm that is doing this padding, you might not need it to implement it in the SP 4303.

I

Says that you had the plain text before encrypting and if you have to pad the plaintiff to reach multiple of 4 at least even if you're, the CCM or GC, even if you aging yeah. Even then, you have to go to a multiple of four that doesn't exist in st. Els, but it doesn't exist in ESP. Of course, you can say that you're doing a modified ESP that doesn't require this alignment, which is fine, probably a good idea. But 4303 says that you have to pad to a multiple for, but.

O

Then the padding is part of the, because all three is a TSP. It's something.

I

That the ESP does are for calling ok.

O

Ok right, that's.

I

The way for you feel free, ok,.

O

Then what is here is wrong um next slide. So I CD was a comment from Valerie about a icv.

D

Yeah, the the comment was: if I CV is optional, does it mean that authentication is optional in ESP.

O

So how do you do that, then, if you have no only.

S

Food, I cv there's a whole bunch of active attacks, which is impossible by someone. Lafayette packet is watching what happens to be quicker, reacts to it. It would strongly recommend that it is that p they optional.

I

Governor, we know exactly how the pictorial rekt rekt, because all those things- oh those algorithms that are defined our stream- well, not free counter mode. So flip a baton. You get to flip a bit on the plaintext very easy.

O

Okay, so, but what I basically want so I, don't know what is written actually in the current draft, but.

O

What I was stating is that not all the algorithm as men, deterring using icv and as as a result, I cv, was not mandatory, knit whole packet. That said, every time you do in an authentication, you need a nice EV and so because, while the algorithm we are recommending are using a CV, it becomes mandatory. So.

O

Yeah about the crypto streets, so we we do not define any recommendation on which suite to use. We just refer to the current draft and we provide some more text explaining why security should not be.

O

What they shouldn't it should not be balanced with reducing the size of the payload or with power conceptions or band with a gain question. Sorry, I again from Valeria. It's.

Q

True that authentication is optionally in ESP, but currently photographer think it is insecure, so ya better to use it always or use a EAD algorithm, yeah.

O

I think the drafts a must it must in an hour, but it's just commenting, so I think we agree on what to we want to say you just finding right words.

O

And so well, we had a quite long section on the cryptographic sweet just to explain. Security should not be done at the deep end of other things, so we recommended, for example, if you want to not not to implement some specific ash function, so you can reuse the AES daddy in this draft for bandwidth constrained avise. Then we provide a few recommendation.

O

You can have a sending payloads that are adapted to reduce the padding side or well remove the IV with using specific suites are yeah I, think that's a don't use a block algorithms like CBC and prefer counter mode things, and that's all about this draft.

C

So this is, if I dressed correctly, are trying to still be exactly standard ESP, but just telling how to how the implementation can. Actually, you know, make things easier by doing some tricks like if you go back a couple of slides ever, let's talk about the next terror of being actually better for work, if you're talking about next 10 or being mandatory, but can be both a fixed value that that's what I saw that if your image is only talking UDP, nothing, yes,.

B

C

Don't have to actually know take a UDP packet and fight there. You know protocol number there and put it there in next header field, but you just always feel 70 there. That's.

F

C

That's what you are.

F

C

To be using ok, so that actually makes it a little bit but I think actually people get a bit confused to actually the original. You know explanation there talk about that. Okay, this is 0. This implementation tricks to implement is easily.

O

C

Really, actually changing any of the beach of the wire yeah.

O

That's it that's.

C

The goal I mean.

O

I, really why this is.

C

Like the implementation guidance talk about actually not not yet.

O

Basically, the idea is that if someone is implementing its own ESP, it's not a ESP base or not base I mean it doesn't break anything, that's the key idea. So before people start making their own tricks, it's we provide them some guidance, and this draft is not expect to be here, but it was here in order to get feedbacks and wish. While we expect a movie to forward into the working group, lwi g, which is for as guidance for smaller implementations, so watch the it's, it's not the working group craft area.

O

Is it going to be adapted that have working group craft there in not yet ok, they're waiting for feedback sword athlete that we presented here.

C

Ok, so that ever actually encourage people to read this and you know think about it at essen. You know this is the minimal. This is how to implement any IPS, be in very, very constrained device and not about thing about it. As you know, this is kara purpose, ipsec implementation. That is doing something. This is like a I had a minimal I question to document their text explaining how to do. You know ETA terse I'd of that, because you never actually never want to be under sponder there, but you're sleeping all the time.

S

Some constraint devices might have problem Jerry read of this, but they have the problems in rear. End asleep, probably should be doing anything with split security, so.

D

So can we get a show of hands for people that have read this trap.

D

34, can we get some volunteers to do reviews of this draft.

D

Thank you. Thank you.

C

And I actually would like to get you guys. Send a comment to the ipsec email. Is that when you have read it? Even if there is nothing you know wrong with it to go. I sure you can find something wrong, but even if you don't find anything just send an email to the list. I say that you have read it, so they actually know that somebody has been ready. Readings so I think that's covers everything we had. Anybody has any other issues.

C

So I think that's it, then anybody has everybody, has side side, the blue seats, I guess.

D

Thank you see in Prague.

X

Gd said set out the etherpad or drops okay. So what's the status we have knowledge.

M

X

If you have a little.

M

Too, you know 70s.

X

To regard I etemadi, that's right amber that.

U

M

Of creating dishes tomorrow, official looking for.

X

Models, yeah I'm connections, flat.

X

L

Y

L

Making for this.

Y

X

Already lost couple.

Y

Of two male two monsters: yes,.

S

L

Y