Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
draft-kelly-ipsec-ciph-sha2-01

[Ballot comment]
1. As I understand this is an independent submission via AD. Is there a PROTO write-up available as per http://www.ietf.org/internet-drafts/draft-iesg-sponsoring-guidelines-01.txt? If there is one, I would like to see it and I suggest it is entered in the tracker.

2. The Abstract Section abunds in non-expanded acronyms.

[Ballot comment]
(Based on Gen-ART review by Miguel Garcia)

IANA considerations section does not specify:

a) The registry IANA has to operate.
b) The subregistry within that registry IANA has to operate
c) A differentiation between instructions to IANA and background
    information to the reader about already assigned values.

Are all the references really normative?

Expand acronyms before first usage.

Add a reference to HMAC-SHA1-96 in the first paragraph of Section 3.1.

[Ballot discuss]
(Based on Gen-ART review by Miguel Garcia)

In Section 1, second paragraph, there are references to
HMAC-SHA-PRF-256, HMAC-SHA-PRF-384, and HMAC-SHA-PRF-512. The same
references appear in the first paragraph in Section 2.4. However, in
the table in Section 2.6 and the test vectors in Section 2.7.1, there
are references to HMAC-SHA-256-PRF, HMAC-SHA-384-PRF, AND
HMAC-SHA-512-PRF. (And in the IANA considerations section the
references are to PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384, and
PRF_HMAC_SHA2_512.)

The reversal of PRF-nnn and nnn-PRF needs to be fixed.

[Ballot discuss]
* Downref: Informational Normative Reference: RFC 2104 (ref. 'HMAC')
  - Downref: Non-RFC Normative Reference: ref. 'SHA2-1'
  - Downref: Non-RFC Normative Reference: ref. 'SHA2-2'

IANA Additional Comments:

In the IANA Considerations section there are three main groups.
The first is there for information only and we don't have
any IANA actions for them. That is what was being clarified
by the author's comments.

The second and third sets of IANA Actions are actually
additions we need to make in the registry located at:

http://www.iana.org/assignments/ikev2-parameters

IANA Last Call Comments:

IANA has questions about the IANA Actions required
for this document.

IANA understands that there are three actions to
be taken upon approval of this document.

In the IKEv2 Parameters registry located at:

http://www.iana.org/assignments/ikev2-parameters

Three new values are to be added to the registry of
transform identifiers (Pseudo-random function) for
transform type 2:

Number Name
------ ---------------------------------
tbd PRF_HMAC_SHA2_256
tbd PRF_HMAC_SHA2_384
tbd PRF_HMAC_SHA2_512

Second, also in the IKEv2 Parameters registry located at:

http://www.iana.org/assignments/ikev2-parameters

three new values are to be added to the registry of
integrity algorithms (for transform type 3):

Number Name
------ ---------------------------------
tbd AUTH_HMAC_SHA2_256_128
tbd AUTH_HMAC_SHA2_384_192
tbd AUTH_HMAC_SHA2_512_256

Finally, in section 4 of the document there is a
requirement to register IKE Phase 2 negotiation
authentication algorithm identifiers. The document
suggestsvalues for these identifiers. The algorithms
and algorithm numbers are:

HMAC-SHA2-256: 5
HMAC-SHA2-384: 6
HMAC-SHA2-512: 7

IANA is not sure where these identifiers should be
registered. Is it in the registry located at:

http://www.iana.org/assignments/ikev2-parameters

in the subregistry with a header marked: "IKEv2
Authentication Method?"