Hi, this version of the draft fixes an inconsistency that was recently discovered. In particular, Section 4.5.3.2 (AUTH_KEY Attribute) at the very end says:
Multiple instances of the AUTH_KEY attributes MUST NOT be sent. This attribute MUST NOT appear in the rekey operations (in the GSA_REKEY or GSA_INBAND_REKEY exchanges). The last sentence is in fact inconsistent with the rest of the document, other parts of the document allow (and even require in some cases) the AUTH_KEY attribute to appear in GSA_REKEY in case of digital signature authentication. Perhaps this was a result of a careless copy-paste operation. The only change in -23 version is that this sentence is deleted, since other parts of the document already contain guidance (including RFC 2119 language) where the AUTH_KEY attribute can appear and where cannot. Please let us know if anyone disagrees with this. Regards, Brian & Valery. > Internet-Draft draft-ietf-ipsecme-g-ikev2-23.txt is now available. It is a > work item of the IP Security Maintenance and Extensions (IPSECME) WG of the > IETF. > > Title: Group Key Management using IKEv2 > Authors: Valery Smyslov > Brian Weis > Name: draft-ietf-ipsecme-g-ikev2-23.txt > Pages: 76 > Dates: 2025-07-31 > > Abstract: > > This document presents an extension to the Internet Key Exchange > version 2 (IKEv2) protocol for the purpose of a group key management. > The protocol is in conformance with the Multicast Security (MSEC) key > management architecture, which contains two components: member > registration and group rekeying. Both components are required for a > GCKS (Group Controller/Key Server) to provide authorized Group > Members (GMs) with IPsec group security associations. The group > members then exchange IP multicast or other group traffic as IPsec > packets. > > This document obsoletes RFC 6407. > > The IETF datatracker status page for this Internet-Draft is: > https://datatracker.ietf.org/doc/draft-ietf-ipsecme-g-ikev2/ > > There is also an HTMLized version available at: > https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-g-ikev2-23 > > A diff from the previous version is available at: > https://author-tools.ietf.org/iddiff?url2=draft-ietf-ipsecme-g-ikev2-23 > > Internet-Drafts are also available by rsync at: > rsync.ietf.org::internet-drafts > > > _______________________________________________ > IPsec mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ IPsec mailing list -- [email protected] To unsubscribe send an email to [email protected]
