@@ -180,10 +180,10 @@ the original EESP SA.
180
180
181
181
** Replay Protection Service
182
182
EESP provides an optional Replay service using
183
- Full 64 bit Sequence Number(TBD10 ), carried in the packet.
183
+ Full 64 bit Sequence Number(TBD9 ), carried in the packet.
184
184
To enable Replay service the initiator SHOULD
185
185
propose Sequence Numbers Properties Transforms,
186
- SNP = (Full 64 bit Sequence Number(TBD10 )) in Substructure of the
186
+ SNP = (Full 64 bit Sequence Number(TBD9 )) in Substructure of the
187
187
Proposal Substructure inside the Security Association (SA) payload
188
188
in the IKEv2 Exchange. When the responder select 64 bit ESN a
189
189
receiver MUST enable Reply Protection.
@@ -211,14 +211,14 @@ may be carried explicitly in every EESP packet.
211
211
212
212
** Implicit Initialization Vectors
213
213
214
- When using the Implicit Initialization Vector (IIV) encryption
215
- algorithm [[RFC8750]], the IV MUST be omitted. To negotiate this,
216
- IIV transforms specified in [[IKEv2-Enc]] MUST be used. Additionally,
217
- [[IKEv2-SNP ]] MUST be negotiated to carry Full 64 bit Sequence Number
218
- in the EESP packet.
219
-
220
- [AA NOTE: should add error message when there no 64 bit SN
221
- and IIV is proposed and EESP is requested??]
214
+ With the Implicit Initialization Vector (IIV) encryption algorithm,
215
+ as specified in [[RFC8750]], the IV MUST be omitted in the EESP
216
+ packet. To enable this functionality, IIV transforms defined in
217
+ [[IKEv2-Enc ]] MUST be used during negotiation. Furthermore,
218
+ the [[IKEv2-SNP]] extension MUST be negotiated to support the use of
219
+ a Full 64-bit Sequence Numbers in EESP packets. If the the proposal
220
+ does not include Full 64-bit Sequence Numbers return error
221
+ INVALID_SNP.
222
222
223
223
** EESP Version
224
224
Each SA need an EESP Base Header version which is specified
@@ -482,19 +482,21 @@ Changes the "Used In" column for the existing allocations as follows;
482
482
This document defines new Notify Message types in the
483
483
"IKEv2 Notify Message Error Types" registry:
484
484
485
- | Value | Notify Message Error Type | Reference |
485
+ | Value | Notify Message Error Type | Reference |
486
486
|-------------+----------------------+-----------------+
487
487
| [TBD2] | INVALID_SESSION_ID | [this document] |
488
488
| [TBD3] | INVALID_SUB_SA | [this document] |
489
+ | [TBD10]| INVALID_SNP | [this document] |
490
+
489
491
490
492
*** Sequence Numbers Properties
491
493
492
494
This document defines a new value in the IKEv2 "Transform Type 5 - Sequence
493
495
Numbers Properties Transform IDs" registry:
494
496
495
- | Value | Name | Reference |
496
- |-------------+--------------------------+------------------ +
497
- | [TBD10] | Full 64-bit Sequence Numbers | [this document] |
497
+ | Value | Name | Reference |
498
+ |-------------+--------------------------+-----------------+
499
+ | [TBD9] | Full 64-bit Sequence Numbers | [this document] |
498
500
499
501
** New Registries
500
502
@@ -516,7 +518,7 @@ IANA is requested to create a new registry named
516
518
|------------+------------- +-----------------+
517
519
| 0 | Unspecified | [this document] |
518
520
| 1 | ENCRYPION_ID | [this document] |
519
- | 2 | SUB_SA_ID | [this document] |
521
+ | 2 | SUB_SA_ID | [this document] |
520
522
521
523
*** EESP Flow ID registry
522
524
@@ -532,7 +534,7 @@ IANA is requested to create a new registry named
532
534
| Flow ID | Name | Reference |
533
535
|---------+--------------+------------------+
534
536
| 0 | Unspecified | [this document] |
535
- | 1 | VNI32 | [this document] |
537
+ | 1 | VNI32 | [this document] |
536
538
| 2 | VNI64 | [this document] |
537
539
| 3 | SUB_SA_16 | [this document] |
538
540
0 commit comments