Intermediate Exchange in the IKEv2 Protocol
draft-ietf-ipsecme-ikev2-intermediate-02

Document Type Active Internet-Draft (ipsecme WG)
Last updated 2019-07-24
Replaces draft-smyslov-ipsecme-ikev2-aux
Stream IETF
Intended RFC status (None)
Formats plain text pdf html bibtex
Stream WG state WG Document
Document shepherd No shepherd assigned
IESG IESG state I-D Exists
Consensus Boilerplate Unknown
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                         V. Smyslov
Internet-Draft                                                ELVIS-PLUS
Intended status: Standards Track                           July 24, 2019
Expires: January 25, 2020

              Intermediate Exchange in the IKEv2 Protocol
                draft-ietf-ipsecme-ikev2-intermediate-02

Abstract

   This documents defines a new exchange, called Intermediate Exchange,
   for the Internet Key Exchange protocol Version 2 (IKEv2).  This
   exchange can be used for transferring large amount of data in the
   process of IKEv2 Security Association (SA) establishment.
   Introducing Intermediate Exchange allows re-using existing IKE
   Fragmentation mechanism, that helps to avoid IP fragmentation of
   large IKE messages, but cannot be used in the initial IKEv2 exchange.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on January 25, 2020.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of

Smyslov                 Expires January 25, 2020                [Page 1]
Internet-Draft         Intermediate IKEv2 Exchange             July 2019

   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology and Notation  . . . . . . . . . . . . . . . . . .   3
   3.  Intermediate Exchange Details . . . . . . . . . . . . . . . .   3
     3.1.  Support for Intermediate Exchange Negotiation . . . . . .   3
     3.2.  Using Intermediate Exchange . . . . . . . . . . . . . . .   4
     3.3.  The IKE_INTERMEDIATE Exchange Protection and
           Authentication  . . . . . . . . . . . . . . . . . . . . .   5
       3.3.1.  Protection of the IKE_INTERMEDIATE Messages . . . . .   5
       3.3.2.  Authentication of the IKE_INTERMEDIATE Exchanges  . .   5
     3.4.  Error Handling in the IKE_INTERMEDIATE Exchange . . . . .   8
   4.  Interaction with other IKEv2 Extensions . . . . . . . . . . .   9
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  10
   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  10
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .  10
     8.2.  Informative References  . . . . . . . . . . . . . . . . .  11
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  11

1.  Introduction

   The Internet Key Exchange protocol version 2 (IKEv2) defined in
   [RFC7296] uses UDP as a transport for its messages.  If size of the
   messages is large enough, IP fragmentation takes place, that may
   interfere badly with some network devices.  The problem is described
   in more detail in [RFC7383], which also defines an extension to the
   IKEv2 called IKE Fragmentation.  This extension allows IKE messages
   to be fragmented at IKE level, eliminating possible issues caused by
   IP fragmentation.  However, the IKE Fragmentation cannot be used in
   the initial IKEv2 exchange (IKE_SA_INIT).  This limitation in most
   cases is not a problem, since the IKE_SA_INIT messages used to be
   small enough not to cause IP fragmentation.

   However, the situation has been changing recently.  One example of
   the need to transfer large amount of data before IKE SA is created is
   using Quantum Computer resistant key exchange methods in IKEv2.
   Recent progress in Quantum Computing has brought a concern that
   classical Diffie-Hellman key exchange methods will become insecure in
   a relatively near future and should be replaced with Quantum Computer
Show full document text