IPSEC Working Group meeting Monday, November 10, Salon A Please reserve the first four rows for people who have read RFC2401-bis or who have reviewed the open/pending issues in the Roundup Issue tracker

IPSEC Agenda ● Agenda Bashing ● Draft Review ● RFC 2401-bis – Open issues review – Revised processing model (Steve Kent) ● Strong Identity Protection Using Hidden Credentials – Hilarie Orman (10 min) ● Camilla (5min) ● BEAT (10 min)

I-D Draft Review, 1 ● Publication Requested (on Russ's reading pile) – draft-ietf-ipsec-ikev2 – draft-ietf-ipsec-ikev2-algorithms – draft-ietf-ipsec-ui-suites ● IESG wait (11-20 telechat) – draft-ietf-ipsec-aes-ccm (a-d goahead) – draft-ietf-ipsec-aes-xcbc-prf – draft-ietf-ipsec-nat-t-ike ● RFC editor queue – draft-ietf-ipsec-ciph-aes-ctr ● MIB docs – dead EXCEPT for draft-ietf-ipsec-flow-monitoring- mib

● Ping A-D – draft-ietf-ipsec-dpd – draft-ietf-ipsec-nat-rqts ● Need new drafts (see draft tracker) – Initial IANA registry file – draft-ietf-ipsec-udp-encaps – draft-ietf-ipsec-esn-addendum (IPsec, IPR, disclaimers) – draft-ietf-ipsec-esp-v3 ● minor references, explicit obsoletes 2406 – draft-ietf-ipsec-rfc-2402bis ● minor references, explicit obsoletes 2402, need mandatory/optional crypto algorithms document for ESP/AH I-D Draft Review, 2

● On-going work – draft-ietf-ipsec-rfc2401bis I-D Draft Review, 3

RFC 2401-bis issues, 1 ● Issue #82: Creation of SAs – clarifications – need better text, pending state ● Issue #85: DROP'd inbound packet -- does not match SA – Use IKEv2 message instead (require re-opening ikev2) ● Issue #88: Lift the prohibition on red-side fragmentation by SG, BITS, BITW (text from Mark Duffy) ● Issue #89: Remove the selector "name" (reject, new text from Karen to clarify use of selector name)

● Issue #90: Remove the selector "data sensitivity level" ● Issue #91: Handling ICMP error messages – proposed text very complicated, diagrams only reflect tunnel mode, need people to review ● Issue #44: Proposed change: forwarding table lookup to select virtual interface ID ● Issue #45: Proposed change: use of cache with de-correlated SPD RFC 2401-bis issues, 2

Steve Kent: revised processing model

RFC 2401-bis timeline (proposed) ● Close all issues by November 30 th ● Final draft by December 15 th ● Start wg last call from Dec. 15 th to January 10 th

Related BOF's ● IKEv2 Mobility and Multihoming – Tuesday, November 11 – Salon B ● Profiling Use of PKI in IPSEC BOF – Thursday, November 13 – Salon F