Re: [IPsec] AES key lengths: draft-ietf-ipsecme-esp-ah-reqts

On Mar 8, 2014, at 8:08 AM, Black, David wrote: >> The next draft changes AES-128-CBC to AES-CBC, and says: >> >> In the following sections, all AES modes are for 128-bit AES. 192-bit AES >> MAY be supported for those modes, but the requirements here are for 128-bit >> AES. > > What about 256-

Re: [IPsec] ICV sizes

Ok, no problem here ... Thanks, --David +++Sent from Blackberry - Original Message - From: Paul Hoffman [mailto:paul.hoff...@vpnc.org] Sent: Saturday, March 08, 2014 09:21 AM To: Black, David Cc: ipsec Subject: ICV sizes On Mar 8, 2014, at 1:37 PM, Black, David wrote: > I have no stro

[IPsec] ICV sizes

On Mar 8, 2014, at 1:37 PM, Black, David wrote: > I have no strong opinion on ICV size for GCM and GMAC, but I am interested > in the outcome as an author of the Block Storage IPsec profile update > (draft-ietf-storm-ipsec-ips-update-04). That draft does not currently > express requirements on I

[IPsec] SHOULD NOT in draft-ietf-ipsecme-esp-ah-reqts

On Mar 8, 2014, at 1:37 PM, Black, David wrote: > - "SHOULD NOT-" is a better keyword than "SHOULD NOT+" How do others feel about this? It feels like a bit of a bikeshed, but we may as well be as helpful as possible. --Paul Hoffman ___ IPsec ma

Re: [IPsec] AES key lengths: draft-ietf-ipsecme-esp-ah-reqts

On Mar 8, 2014, at 1:08 PM, Black, David wrote: > What about 256-bit AES keys? They should also be a "MAY". Good catch. --Paul Hoffman ___ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec

Re: [IPsec] Working Group Last Call: draft-ietf-ipsecme-esp-ah-reqts

Hi Paul, > The draft lists the following trasforms based on AES cipher: > > AES-GCM > AES-CCM > AES-CTR > AES-128-CBC > AES-GMAC > AES-XCBC-MAC-96 > > All these transforms, except for AES-XCBC-MAC-96, > allows to be used with different key lengths - 128, 192 and 256 bits. > It looks strange to m

[IPsec] WGLC comments: draft-ietf-ipsecme-esp-ah-reqts

The draft looks very good. Aside from my previous comment on 256-bit AES keys, I want to +1 three things I've seen in this discussion: - DES should be "MUST NOT" - "SHOULD NOT-" is a better keyword than "SHOULD NOT+" - NULL authentication for use with AES GCM should be at

[IPsec] AES key lengths: draft-ietf-ipsecme-esp-ah-reqts

> The next draft changes AES-128-CBC to AES-CBC, and says: > > In the following sections, all AES modes are for 128-bit AES. 192-bit AES > MAY be supported for those modes, but the requirements here are for 128-bit > AES. What about 256-bit AES keys? They should also be a "MAY". Thanks, --David

Re: [IPsec] Working Group Last Call: draft-ietf-ipsecme-esp-ah-reqts

On Mar 3, 2014, at 3:04 PM, RJ Atkinson wrote: >> Perhaps some text along the line of: >> >> ESP-NULL offers the same protection as AH, ... > > This sentence above is not true. ESP-NULL and AH provide > different security properties to the IP-layer. The next draft has more careful word

Re: [IPsec] Working Group Last Call: draft-ietf-ipsecme-esp-ah-reqts

On Mar 3, 2014, at 12:02 PM, Valery Smyslov wrote: > The draft lists the following trasforms based on AES cipher: > > AES-GCM > AES-CCM > AES-CTR > AES-128-CBC > AES-GMAC > AES-XCBC-MAC-96 > > All these transforms, except for AES-XCBC-MAC-96, > allows to be used with different key lengths - 128

Re: [IPsec] Some comments to draft-plmrs-ipsecme-ipsec-ikev2-context-definition-01

On Mar 5, 2014, at 11:07 PM, Tero Kivinen wrote: > In section 2 it says: > > Note that IKEv2 and IPsec session do not need to be on the same node > as IKEv2 and IPsec context are different. > > This is not so easy. The RFC5996 says: > > -

[IPsec] Minutes from IETF 89

...are posted at . Many thanks to Peter Yee for thoroughness. If you have any comments on the topics presented, please start a separate thread. --Paul Hoffman ___ IPsec mailing list IPsec