Status report for draft-ietf-ipsec-pki-profile Paul Hoffman, Director VPN Consortium for Brian Korver

Recent status Brian Korver turned in draft-ietf-ipsec-pki- profile-04 sent to the list last week Currently available at Will be posted to main IETF repository after this week

Reorganization Identities in certs and ID payloads are now discussed in fewer places Introductions appear only once for many topics More to be done: trying to shorten the document by collecting topics into one place

Mailing list issues on identity Significance of the ID payload Which ID fields in certs MUST be supported How to tie IKE ID to Cert contents

MUST be able to send IDs of... IP address DNS name address Subject names MUST NOT send IP ranges or KeyIDs

Matching the ID payload to the cert contents The ID in the ID payload MUST match the contents of the corresponding field (listed) in the certificate exactly, with no other lookup. The matched ID MAY be used for SPD lookup, but is not required to be used for this. Mappings: –IPV{4|6}_ADDR  SubjAltName iPAddress –FQDN  SubjAltName dNSName –USER_FQDN  SubjAltName rfc822Name –DN  Entire Subject, bitwise compare

Matching the ID to the SPD For IP addresses, addresses, and DNS names, you MUST be able to support exact matching in the SPD, but MAY also support substring or wildcard matches. For Subjects, MUST support lookup on any combination of C, CN, O, or OU. You MAY also support substring or wildcard matches. You MAY match on additional cert DN attributes, but all bets are off for interop.

Other list agreements Both sides must always send their own certificates No other certificate payloads: all PKI lifecycle information is carried in its own protocol. –Need to deal with situations where that protocol must be run over IPsec

Next version of the draft will... Be more consistent on these changes Coalesce more related topics so reading is easier Deal with even more open issues from the mailing list

Next steps Should this document be a WG item? What are the open issues remaining?