From acondition@ffpa.com Thu Nov 01 08:37:45 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1InZIv-00048U-C8; Thu, 01 Nov 2007 08:37:45 -0400 Received: from p549bb885.dip0.t-ipconnect.de ([84.155.184.133]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1InZIh-00087p-Ed; Thu, 01 Nov 2007 08:37:40 -0400 Received: (qmail 6568 invoked from network); Thu, 1 Nov 2007 13:38:52 +0100 Received: from unknown (HELO sebi) (acondition@ffpa.com@80.107.63.35) by 85b89b54ffpa.com with SMTP; Thu, 1 Nov 2007 13:38:52 +0100 Message-ID: <001a01c81c8c$8ac19240$069bc71c@sebi> From: Rachael V. Strickland To: imapext-archive@lists.ietf.org Subject: To so different Date: Thu, 1 Nov 2007 13:38:52 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0017_01C81C8C.8AC19240" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.181 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2462.1106 X-Spam-Score: 4.3 (++++) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 This is a multi-part message in MIME format. ------=_NextPart_000_0017_01C81C8C.8AC19240 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable have most definitely made an impact in this industry, whether its after pla= ce to access your target. Moreover, telecommunication compared to just scanning the image and adjusting the size on the ------=_NextPart_000_0017_01C81C8C.8AC19240 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable

telecommunications industry will probably be the main and most

Are you wanting a bigger p_ e > n _is?

As seen on TV

Over 709,000 Men around the world are already satisfied
Gain 3+ Inches In Leng _th
Increase Your P _en -is Wi _dth (Girth) By up _to 28%
100% Safe To Take, With NO Side Effects
No Pum _ps! No Surgery! No Exercises!
*3 F _RE >E Bottles

Result pics<= /font>

INTERNET. A Canadian researcher communicating in English may
------=_NextPart_000_0017_01C81C8C.8AC19240-- From wagactcertifiedsupportdon@actcertifiedsupport.com Thu Nov 01 16:21:58 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IngYA-00076F-U5; Thu, 01 Nov 2007 16:21:58 -0400 Received: from nat-mo2.aster.pl ([212.76.37.134]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IngXy-0000ZP-RS; Thu, 01 Nov 2007 16:21:56 -0400 Received: from [212.76.37.134] by mail.actcertifiedsupport.com; Thu, 1 Nov 2007 21:23:35 +0100 Date: Thu, 1 Nov 2007 21:23:35 +0100 From: "Terry Cates" X-Mailer: The Bat! (v2.00.0) Educational Reply-To: wagactcertifiedsupportdon@actcertifiedsupport.com X-Priority: 3 (Normal) Message-ID: <408560690.10896996584061@actcertifiedsupport.com> To: 6lowpan@lists.ietf.org Subject: Legal software sales MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------46E7AC6EE7318FB" X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca ------------46E7AC6EE7318FB Content-Type: text/plain; charset=Windows-1252 Content-Transfer-Encoding: 7bit Our purpose is to render low price PC and Macintosh lawful soft and computer solutions for any budget. Whether you are a corporate client, an owner of small business, or go shopping for your own home personal computer, we suppose that we'll assist you. CHECK WHAT WE HAVE TO PROPOSE http://pspeqko.ourtopoemstore.com/ Most demanding products are: *Macromedia Studio 8 for Mac: Retail price for today - $999.99; Our now - $99.95 *Macromedia Director MX v9.0: Retail price today - $1101.00; Our only - $49.95 *Adobe Illustrator CS2: Retail price this day - $499.00; Our only for this time - $59.95 *Symantec WinFax Pro V 10.03: Retail price today - $100.00; Our only - $19.95 *Symantec Norton Save & Restore 2.0: Retail price now - $49.99; Our this day - $19.95 *Macromedia Contribute 3.11: Retail price for now - $149.00; Our just - $39.95 *Microsoft OneNote 2003 Professional (DEUTSCH): Retail price for this day - $169.00; Our only - $29.95 *Acronis True Image 7.0: Retail price for this day - $49.99; Our only - $19.95 COME TO US JUST NOW! http://pspeqko.ourtopoemstore.com/ ------------46E7AC6EE7318FB Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit Our purpose is to render low price PC and Macintosh lawful soft and computer solutions for any budget.
Whether you are a corporate client, an owner of small business,
or go shopping for your own home personal computer, we suppose that we'll assist you.
CHECK WHAT WE HAVE TO PROPOSE
http://pspeqko.ourtopoemstore.com/
Most demanding products are:
*Macromedia Studio 8 for Mac: Retail price for today - $999.99; Our now - $99.95
*Macromedia Director MX v9.0: Retail price today - $1101.00; Our only - $49.95
*Adobe Illustrator CS2: Retail price this day - $499.00; Our only for this time - $59.95
*Symantec WinFax Pro V 10.03: Retail price today - $100.00; Our only - $19.95
*Symantec Norton Save & Restore 2.0: Retail price now - $49.99; Our this day - $19.95
*Macromedia Contribute 3.11: Retail price for now - $149.00; Our just - $39.95
*Microsoft OneNote 2003 Professional (DEUTSCH): Retail price for this day - $169.00; Our only - $29.95
*Acronis True Image 7.0: Retail price for this day - $49.99; Our only - $19.95
COME TO US JUST NOW!
http://pspeqko.ourtopoemstore.com/ ------------46E7AC6EE7318FB-- From dojadacskiatlashul@adacskiatlas.com Thu Nov 01 18:35:29 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1InidN-0003UV-Mf; Thu, 01 Nov 2007 18:35:29 -0400 Received: from 189-10-123-120.bsace702.dsl.brasiltelecom.net.br ([189.10.123.120] helo=dsldevice.lan) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Inid8-0005az-Oc; Thu, 01 Nov 2007 18:35:20 -0400 Received: from [189.10.123.120] by mta.inode.at; Thu, 1 Nov 2007 19:37:04 -0300 Date: Thu, 1 Nov 2007 19:37:04 -0300 From: "Christian Calderon" X-Mailer: The Bat! (v2.00.0) Personal Reply-To: dojadacskiatlashul@adacskiatlas.com X-Priority: 3 (Normal) Message-ID: <872487060.56853337471641@adacskiatlas.com> To: 6lowpan@lists.ietf.org Subject: Other guys are improving themselves..are you? MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------821367B8297B80" X-Spam-Score: 4.9 (++++) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 ------------821367B8297B80 Content-Type: text/plain; charset=Windows-1252 Content-Transfer-Encoding: 7bit At last, the real stuff - without rip offs! P.E.P. are hot right this time! Well this is the genuine thing not a counterfeit! One of the very exceptionals, totally unparalleled product is on sale around the world! Pay attention to just what people say on this stuff: "I love how quick this product had an affect on my boyfriend, he can no way stop talking on how hot he is having his new size, length, and libido!" Silvia D., Chicago "Firstly I decided the gratuitous sample I was given was some kind of joke, till I actually tried taking the P.E.P. I can’t describe report how plume I am with the outcome from using the patch for 7 short weeks. I will be requesting on a constant basis!" Charley Mock, Chicago Look at more recommendations about this astonishing product right here! http://www.uontwoy.com/?jfgyucocuop ------------821367B8297B80 Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit At last, the real stuff - without rip offs!
P.E.P. are hot right this time! Well this is the genuine thing not a counterfeit!
One of the very exceptionals, totally unparalleled product is on sale around the world!
Pay attention to just what people say on this stuff:

"I love how quick this product had an affect on my boyfriend, he can no way stop talking on how hot he is having his new size, length, and libido!"

Silvia D., Chicago

"Firstly I decided the gratuitous sample I was given was some kind of joke, till I actually tried taking the P.E.P. I can’t describe report how plume I am with the outcome from using the patch for 7 short weeks. I will be requesting on a constant basis!"

Charley Mock, Chicago
Look at more recommendations about this astonishing product right here!
 http://www.uontwoy.com/?jfgyucocuop ------------821367B8297B80-- From ipsec-bounces@ietf.org Thu Nov 01 21:55:08 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1InlcM-0004dl-20; Thu, 01 Nov 2007 21:46:38 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1InlcK-0004dJ-JQ for ipsec-confirm+ok@megatron.ietf.org; Thu, 01 Nov 2007 21:46:36 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1InlcK-0004ab-91 for ipsec@ietf.org; Thu, 01 Nov 2007 21:46:36 -0400 Received: from numenor.qualcomm.com ([129.46.51.58]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1InlcE-0006P5-RV for ipsec@ietf.org; Thu, 01 Nov 2007 21:46:31 -0400 Received: from hamtaro.qualcomm.com (hamtaro.qualcomm.com [129.46.61.157]) by numenor.qualcomm.com (8.13.6/8.12.5/1.0) with ESMTP id lA21kTtO026553 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Thu, 1 Nov 2007 18:46:29 -0700 Received: from SANEXCAS02.na.qualcomm.com (sanexcas02.qualcomm.com [172.30.36.176]) by hamtaro.qualcomm.com (8.13.6/8.13.6/1.0) with ESMTP id lA21kT4F010767; Thu, 1 Nov 2007 18:46:29 -0700 (PDT) Received: from NAEX13.na.qualcomm.com ([129.46.51.248]) by SANEXCAS02.na.qualcomm.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 1 Nov 2007 18:46:28 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Thu, 1 Nov 2007 18:46:26 -0700 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: TS updates in MOBIKE Thread-Index: Acgc8i6S1HkJvYhqS3+HfTzyPE2Eqg== From: "Narayanan, Vidya" To: X-OriginalArrivalTime: 02 Nov 2007 01:46:28.0979 (UTC) FILETIME=[2FCE9430:01C81CF2] X-Spam-Score: -4.0 (----) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed Cc: ipsec@ietf.org Subject: [IPsec] TS updates in MOBIKE X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Hi, RFC4555 only allows updates to tunnel endpoint addresses and not selectors, etc. Does anyone know why TS updates are not permitted? If MOBIKE allowed what an SA rekey would allow, what is the problem? =20 Thanks, Vidya _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From KendrapregnantRicks@opensecrets.org Thu Nov 01 22:06:43 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Inlvm-0000E8-FR; Thu, 01 Nov 2007 22:06:42 -0400 Received: from [58.37.142.152] (helo=e9263d35638c422) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Inlv3-0006ve-MM; Thu, 01 Nov 2007 22:05:58 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host40105296.opensecrets.org (8.13.1/8.13.1) with SMTP id LsxTWxA996.146144.E6C.lP6.8513522958757 for ; Fri, 2 Nov 2007 10:04:30 -0800 Message-ID: <1581701c81cf4$c056c890$0901a8c0@E9263D35638C422> From: "Jody Hairston" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_15813_01C81CF4.C056C890-- From ipsec-bounces@ietf.org Fri Nov 02 01:32:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Inp2X-0004FX-GY; Fri, 02 Nov 2007 01:25:53 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Inp2W-0004FM-6M for ipsec-confirm+ok@megatron.ietf.org; Fri, 02 Nov 2007 01:25:52 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Inp2R-0004Ar-9W for ipsec@ietf.org; Fri, 02 Nov 2007 01:25:50 -0400 Received: from [2001:14b8:400::130] (helo=smtp.piuha.net) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Inp2Q-0000WL-34 for ipsec@ietf.org; Fri, 02 Nov 2007 01:25:47 -0400 Received: from smtp.piuha.net (localhost [127.0.0.1]) by smtp.piuha.net (Postfix) with ESMTP id 4D3851986C6; Fri, 2 Nov 2007 07:25:42 +0200 (EET) Received: from [127.0.0.1] (unknown [IPv6:2001:14b8:400::130]) by smtp.piuha.net (Postfix) with ESMTP id E547C19867C; Fri, 2 Nov 2007 07:25:41 +0200 (EET) Message-ID: <472AB4D5.6050809@piuha.net> Date: Fri, 02 Nov 2007 07:25:41 +0200 From: Jari Arkko User-Agent: Thunderbird 1.5.0.14pre (X11/20071022) MIME-Version: 1.0 To: "Narayanan, Vidya" References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP X-Spam-Score: -1.4 (-) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Cc: ipsec@ietf.org, mobike@machshav.com Subject: [IPsec] Re: [Mobike] TS updates in MOBIKE X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Presumably because MOBIKE is a mobility and multihoming facility for IPsec clients and gateways, i.e., you can change the outer IP addresses. Its not a general SA renegotiation facility. Yes, it could be done, but I'm not sure that's really within the scope of the feature. Unless we are talking about extension to deal with transport mode, which has been something at least a few people were interested in. Jari Narayanan, Vidya kirjoitti: > Hi, > RFC4555 only allows updates to tunnel endpoint addresses and not > selectors, etc. Does anyone know why TS updates are not permitted? If > MOBIKE allowed what an SA rekey would allow, what is the problem? > > Thanks, > Vidya > _______________________________________________ > Mobike mailing list > Mobike@machshav.com > https://www.machshav.com/mailman/listinfo.cgi/mobike > > > _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Marita890@eikobr.com Fri Nov 02 05:03:27 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1InsR5-0000r9-NR for ipsec-archive@lists.ietf.org; Fri, 02 Nov 2007 05:03:27 -0400 Received: from [85.97.193.57] (helo=dsl.static859719357.ttnet.net.tr) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1InsR4-000653-5q for ipsec-archive@lists.ietf.org; Fri, 02 Nov 2007 05:03:27 -0400 Received: from muftuluk by eikobr.com with ASMTP id 93D89ED3 for ; Fri, 2 Nov 2007 11:03:42 +0200 Received: from muftuluk ([187.194.38.2]) by eikobr.com with ESMTP id AD22C683B32F for ; Fri, 2 Nov 2007 11:03:42 +0200 Message-ID: <000d01c81d2f$3a5708f0$39c16155@muftuluk> From: "Marita elbazzaz" To: Subject: geweiden Date: Fri, 2 Nov 2007 11:03:25 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C81D3F.FDDFD8F0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 0.1 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 ------=_NextPart_000_0004_01C81D3F.FDDFD8F0 Content-Type: text/plain; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable hello kitty baby ipsec-archive she should accept you as you are but she doesn't like your small dick! http://dodgeti.com/ Marita elbazzaz ------=_NextPart_000_0004_01C81D3F.FDDFD8F0 Content-Type: text/html; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable
hello kitty baby ipsec-archive
she should accept you as you are but she = doesn't like=20 your small dick!
http://dodgeti.com/
Marita elbazzaz
------=_NextPart_000_0004_01C81D3F.FDDFD8F0-- From dojadcapitalhul@adcapital.de Fri Nov 02 07:16:12 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1InuVY-0002vc-QY; Fri, 02 Nov 2007 07:16:12 -0400 Received: from [189.25.26.120] (helo=18925026120.user.veloxzone.com.br) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1InuVK-0001dw-VJ; Fri, 02 Nov 2007 07:16:00 -0400 Received: from [189.25.26.120] by mail.arcor-ip.de; Fri, 2 Nov 2007 08:16:55 -0300 Date: Fri, 2 Nov 2007 08:16:55 -0300 From: "Jeanie Helton" X-Mailer: The Bat! (v2.12.00) Business Reply-To: dojadcapitalhul@adcapital.de X-Priority: 3 (Normal) Message-ID: <587837264.39650416778117@adcapital.de> To: 6lowpan@lists.ietf.org Subject: Dear Customer Feel Good Now! MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------1012542CFFF8BDA3" X-Spam-Score: 0.6 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 ------------1012542CFFF8BDA3 Content-Type: text/plain; charset=windows-1250 Content-Transfer-Encoding: 7bit Information Letter: My dear customer, Ultimately our NEW pharmaceutics web page is accomplished!!! As usually we only propose: - All popular pharmaceutics are accessible! - We shipping worldwide - With No Doctor Calls - Without Any Prescriptions - 100% Customer Guarantee Visit to See our Newly-opened Discount Store and KEEP your chips SAFE!!! http://tailsolve.cn/ ------------1012542CFFF8BDA3 Content-Type: text/html; charset=windows-1250 Content-Transfer-Encoding: 7bit Information Letter:

My dear customer,
Ultimately our NEW pharmaceutics web page is accomplished!!!

As usually we only propose:
- All popular pharmaceutics are accessible!
- We shipping worldwide
- With No Doctor Calls
- Without Any Prescriptions
- 100% Customer Guarantee

Visit to See our Newly-opened Discount Store and KEEP your chips SAFE!!!
http://tailsolve.cn/ ------------1012542CFFF8BDA3-- From rofadiworlddoz@adiworld.net Fri Nov 02 09:59:14 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Inx3K-0002ZM-Tx; Fri, 02 Nov 2007 09:59:14 -0400 Received: from [85.104.63.177] (helo=dsl85-104-16305.ttnet.net.tr) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Inx3A-0006wL-7b; Fri, 02 Nov 2007 09:59:09 -0400 Received: from [85.104.63.177] by mx5.biz.mail.yahoo.com; Fri, 2 Nov 2007 16:00:00 +0200 Date: Fri, 2 Nov 2007 16:00:00 +0200 From: "Sonja Nieves" X-Mailer: The Bat! (v2.00.18) Educational Reply-To: rofadiworlddoz@adiworld.net X-Priority: 3 (Normal) Message-ID: <064489060.08273905232853@adiworld.net> To: 6lowpan@lists.ietf.org Subject: Software MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------B6E92CBDA75842" X-Spam-Score: 1.6 (+) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 ------------B6E92CBDA75842 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Looking for the best costin software abatements? Right now you'll get the chance to have the softwares you want from long time. And the best thing for you is, all softwares are terribly cheap. Examine by yourself and take the softwares for lowest rates! http://mqymnuh.prooemsoft.com/ ------------B6E92CBDA75842 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 7bit
Looking for the best costin software abatements?
Right now you'll get the chance to have the softwares you want from long time.
And the best thing for you is, all softwares are terribly cheap.
Examine by yourself and take the softwares for lowest rates!
http://mqymnuh.prooemsoft.com/ ------------B6E92CBDA75842-- From YolandainfestationLehman@hindu.com Fri Nov 02 12:53:19 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Inzln-00014Z-0P; Fri, 02 Nov 2007 12:53:19 -0400 Received: from 85-18-201-175.ip.fastwebnet.it ([85.18.201.175] helo=francesca.fastwebnet.it) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Inzlm-0005DR-Fe; Fri, 02 Nov 2007 12:53:18 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host79216729.hindu.com (8.13.1/8.13.1) with SMTP id blnE1ZvP21.075091.nco.mCW.9088479641462 for ; Fri, 2 Nov 2007 17:53:05 -0100 Message-ID: <485fa01c81d70$dfed1b60$1912e71c@francesca> From: "Katie Whaley" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_485F6_01C81D70.DFED1B60-- From ipsec-bounces@ietf.org Fri Nov 02 13:49:32 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io0YQ-0006Qh-C1; Fri, 02 Nov 2007 13:43:34 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Io0YM-0006QE-UW for ipsec-confirm+ok@megatron.ietf.org; Fri, 02 Nov 2007 13:43:30 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io0YM-0006Q2-Iq for ipsec@ietf.org; Fri, 02 Nov 2007 13:43:30 -0400 Received: from ithilien.qualcomm.com ([129.46.51.59]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Io0YG-00071V-AG for ipsec@ietf.org; Fri, 02 Nov 2007 13:43:30 -0400 Received: from sabrina.qualcomm.com (sabrina.qualcomm.com [129.46.61.150]) by ithilien.qualcomm.com (8.13.6/8.12.5/1.0) with ESMTP id lA2Hh7iC019654 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Fri, 2 Nov 2007 10:43:08 -0700 Received: from SANEXCAS02.na.qualcomm.com (sanexcas02.qualcomm.com [172.30.36.176]) by sabrina.qualcomm.com (8.13.6/8.13.6/1.0) with ESMTP id lA2Hh4JB023550; Fri, 2 Nov 2007 10:43:06 -0700 Received: from NAEX13.na.qualcomm.com ([129.46.51.248]) by SANEXCAS02.na.qualcomm.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 2 Nov 2007 10:43:05 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Fri, 2 Nov 2007 10:43:03 -0700 Message-ID: In-Reply-To: <472AB4D5.6050809@piuha.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Mobike] TS updates in MOBIKE Thread-Index: AcgdEPPLpNWDqHT8QaGkDqNG2bCfqwAZGlpA References: <472AB4D5.6050809@piuha.net> From: "Narayanan, Vidya" To: "Jari Arkko" X-OriginalArrivalTime: 02 Nov 2007 17:43:05.0945 (UTC) FILETIME=[D3108C90:01C81D77] X-Spam-Score: -4.0 (----) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Cc: ipsec@ietf.org, mobike@machshav.com Subject: [IPsec] RE: [Mobike] TS updates in MOBIKE X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Hi Jari,=20 > -----Original Message----- > From: Jari Arkko [mailto:jari.arkko@piuha.net]=20 > Sent: Thursday, November 01, 2007 10:26 PM > To: Narayanan, Vidya > Cc: mobike@machshav.com; ipsec@ietf.org > Subject: Re: [Mobike] TS updates in MOBIKE >=20 > Presumably because MOBIKE is a mobility and multihoming=20 > facility for IPsec clients and gateways, i.e., you can change=20 > the outer IP addresses. Its not a general SA renegotiation facility. >=20 Yes, I understand that that is the purpose of MOBIKE. But, I don't see a good reason to prevent other updates from happening as part of that same exchange. For e.g., let's say that when my address changes, I want to update the SA (or rekey) to start encrypting some additional traffic (fitting different selector criteria) using the same SA - the initiator now has to do separate MOBIKE and rekeying exchanges, which is not really efficient.=20 > Yes, it could be done, but I'm not sure that's really within=20 > the scope of the feature. Unless we are talking about=20 > extension to deal with transport mode, which has been=20 > something at least a few people were interested in. >=20 I think the above point of updating the SAs applies equally to transport and tunnel mode, but, extending MOBIKE for transport mode is independently useful in my view.=20 Regards, Vidya > Jari >=20 > Narayanan, Vidya kirjoitti: > > Hi, > > RFC4555 only allows updates to tunnel endpoint addresses and not=20 > > selectors, etc. Does anyone know why TS updates are not=20 > permitted? =20 > > If MOBIKE allowed what an SA rekey would allow, what is the problem? > > > > Thanks, > > Vidya > > _______________________________________________ > > Mobike mailing list > > Mobike@machshav.com > > https://www.machshav.com/mailman/listinfo.cgi/mobike > > > > > > =20 >=20 _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Fri Nov 02 15:36:37 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io2GH-0003ay-VV; Fri, 02 Nov 2007 15:32:57 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Io2GG-0003a8-Ks for ipsec-confirm+ok@megatron.ietf.org; Fri, 02 Nov 2007 15:32:56 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io2GF-0003Zn-Sv for ipsec@ietf.org; Fri, 02 Nov 2007 15:32:55 -0400 Received: from mail.ca.certicom.com ([38.113.160.197]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Io2G9-0003Qk-KW for ipsec@ietf.org; Fri, 02 Nov 2007 15:32:55 -0400 Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id 5775610027FE3; Fri, 2 Nov 2007 15:32:39 -0400 (EDT) Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm.certicom.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 79HrJE8BSjX7; Fri, 2 Nov 2007 15:32:32 -0400 (EDT) Received: from domino1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP; Fri, 2 Nov 2007 15:32:32 -0400 (EDT) Received: from [10.24.0.102] ([10.24.0.102]) by domino1.certicom.com (Lotus Domino Release 7.0.2FP2 HF177) with ESMTP id 2007110215321221-195361 ; Fri, 2 Nov 2007 15:32:12 -0400 Message-ID: <472B7BBA.90604@certicom.com> Date: Fri, 02 Nov 2007 15:34:18 -0400 From: Chinh Nguyen User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: "Narayanan, Vidya" Subject: Re: [IPsec] RE: [Mobike] TS updates in MOBIKE References: <472AB4D5.6050809@piuha.net> In-Reply-To: X-MIMETrack: Itemize by SMTP Server on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/02/2007 03:32:12 PM, Serialize by Router on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/02/2007 03:32:14 PM, Serialize complete at 11/02/2007 03:32:14 PM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Spam-Score: 0.0 (/) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Efficiency is overrated. But all joking aside, the UPDATE_SA notify payload is part of an informational exchange. Informationals do not contain the necessary payloads to "update an SA" such as TS, KE, and even SA payloads. The alternative is to allow the UPDATE_SA notify payload to be part of a CREATE_CHILD_SA message. If so, it must be further specified that there are now 2 ways to UPDATE_SA: a regular end-point update via an informational, and a end-point + TS + [etc.] update via a create child sa. Since this is a reasonably major change to the MOBIKE spec, which is already an RFC, you may need a compelling use-case scenario. A saving of 2 additional packets (for the extra rekey to change the TS) may not be sufficient reason to blur the current functional boundaries. Chinh -- http://www.certicom.com Narayanan, Vidya wrote: > Hi Jari, > >> -----Original Message----- >> From: Jari Arkko [mailto:jari.arkko@piuha.net] >> Sent: Thursday, November 01, 2007 10:26 PM >> To: Narayanan, Vidya >> Cc: mobike@machshav.com; ipsec@ietf.org >> Subject: Re: [Mobike] TS updates in MOBIKE >> >> Presumably because MOBIKE is a mobility and multihoming >> facility for IPsec clients and gateways, i.e., you can change >> the outer IP addresses. Its not a general SA renegotiation facility. >> > > Yes, I understand that that is the purpose of MOBIKE. But, I don't see > a good reason to prevent other updates from happening as part of that > same exchange. For e.g., let's say that when my address changes, I want > to update the SA (or rekey) to start encrypting some additional traffic > (fitting different selector criteria) using the same SA - the initiator > now has to do separate MOBIKE and rekeying exchanges, which is not > really efficient. > >> Yes, it could be done, but I'm not sure that's really within >> the scope of the feature. Unless we are talking about >> extension to deal with transport mode, which has been >> something at least a few people were interested in. >> > > I think the above point of updating the SAs applies equally to transport > and tunnel mode, but, extending MOBIKE for transport mode is > independently useful in my view. > > Regards, > Vidya > > >> Jari >> >> Narayanan, Vidya kirjoitti: >>> Hi, >>> RFC4555 only allows updates to tunnel endpoint addresses and not >>> selectors, etc. Does anyone know why TS updates are not >> permitted? >>> If MOBIKE allowed what an SA rekey would allow, what is the problem? >>> >>> Thanks, >>> Vidya >>> _______________________________________________ >>> Mobike mailing list >>> Mobike@machshav.com >>> https://www.machshav.com/mailman/listinfo.cgi/mobike >>> >>> >>> > > > _______________________________________________ > IPsec mailing list > IPsec@ietf.org > https://www1.ietf.org/mailman/listinfo/ipsec _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From MorganwherewithalShook@techcrunch.com Fri Nov 02 15:58:56 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io2fQ-0002Lp-Bt; Fri, 02 Nov 2007 15:58:56 -0400 Received: from adsl-76-235-170-152.dsl.klmzmi.sbcglobal.net ([76.235.170.152] helo=chardonnay) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Io2fM-0004wK-Pw; Fri, 02 Nov 2007 15:58:53 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host49923799.techcrunch.com (8.13.1/8.13.1) with SMTP id OddtOfYB28.764705.rz8.14j.7691116159996 for ; Fri, 2 Nov 2007 16:58:13 +0500 Message-ID: From: "Eugenia Jarrett" To: Subject: Your health Date: Fri, 2 Nov 2007 16:58:13 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_D8202_01C81D93.24BE2BE0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_D8202_01C81D93.24BE2BE0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_D8202_01C81D93.24BE2BE0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_D8202_01C81D93.24BE2BE0-- From ClaricetransiteLangford@indianfootball.com Fri Nov 02 16:43:30 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io3MX-0008IV-O4; Fri, 02 Nov 2007 16:43:29 -0400 Received: from pool-71-123-114-191.spfdma.east.verizon.net ([71.123.114.191] helo=mike.myhome.westell.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Io3MS-0006SB-7r; Fri, 02 Nov 2007 16:43:24 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host98023454.indianfootball.com (8.13.1/8.13.1) with SMTP id L2LSzzwf68.394683.GiN.vp1.6432095862875 for ; Fri, 2 Nov 2007 16:43:12 +0500 Message-ID: From: "Clarice Lovett" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_E59D_01C81D91.032578F0-- From NelliecornmealDowney@closersounds.com Fri Nov 02 17:04:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io3gT-0002F2-IT; Fri, 02 Nov 2007 17:04:05 -0400 Received: from dup-200-64-143-239.prodigy.net.mx ([200.64.143.239] helo=equipo7) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Io3gP-0007Qw-R6; Fri, 02 Nov 2007 17:04:05 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host53692253.closersounds.com (8.13.1/8.13.1) with SMTP id n8tyLjcX45.442786.Vyc.rBJ.5656824916536 for ; Fri, 2 Nov 2007 15:02:33 +0600 Message-ID: <2085901c81d93$d6f86460$0800a8c0@equipo7> From: "Maureen Couch" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_20855_01C81D93.D6F86460-- From ipsec-bounces@ietf.org Fri Nov 02 17:19:42 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io3px-0007ir-78; Fri, 02 Nov 2007 17:13:53 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Io3pw-0007iJ-3T for ipsec-confirm+ok@megatron.ietf.org; Fri, 02 Nov 2007 17:13:52 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io3pv-0007iB-QC for ipsec@ietf.org; Fri, 02 Nov 2007 17:13:51 -0400 Received: from mx12.bbn.com ([128.33.0.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Io3pn-0008AG-UR for ipsec@ietf.org; Fri, 02 Nov 2007 17:13:51 -0400 Received: from dhcp89-089-071.bbn.com ([128.89.89.71]) by mx12.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1Io3pV-00089E-5o; Fri, 02 Nov 2007 17:13:26 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <472AB4D5.6050809@piuha.net> Date: Fri, 2 Nov 2007 17:02:38 -0400 To: "Narayanan, Vidya" From: Stephen Kent Subject: [IPsec] RE: [Mobike] TS updates in MOBIKE Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org At 10:43 AM -0700 11/2/07, Narayanan, Vidya wrote: >Hi Jari, > >> -----Original Message----- >> From: Jari Arkko [mailto:jari.arkko@piuha.net] >> Sent: Thursday, November 01, 2007 10:26 PM >> To: Narayanan, Vidya >> Cc: mobike@machshav.com; ipsec@ietf.org >> Subject: Re: [Mobike] TS updates in MOBIKE >> >> Presumably because MOBIKE is a mobility and multihoming >> facility for IPsec clients and gateways, i.e., you can change >> the outer IP addresses. Its not a general SA renegotiation facility. >> > >Yes, I understand that that is the purpose of MOBIKE. But, I don't see >a good reason to prevent other updates from happening as part of that >same exchange. For e.g., let's say that when my address changes, I want >to update the SA (or rekey) to start encrypting some additional traffic >(fitting different selector criteria) using the same SA - the initiator >now has to do separate MOBIKE and rekeying exchanges, which is not >really efficient. > >> Yes, it could be done, but I'm not sure that's really within >> the scope of the feature. Unless we are talking about >> extension to deal with transport mode, which has been >> something at least a few people were interested in. >> > >I think the above point of updating the SAs applies equally to transport >and tunnel mode, but, extending MOBIKE for transport mode is >independently useful in my view. > >Regards, >Vidya Vidya, So long as the only change is to the outer headers, this is viewed as a MOBIKE issue, not a core IPsec issue. If you want to make TS changes, then this becomes an IPsec architecture issue and needs to be more closely examined. So, I think the agreement was to let IKE continue to do the more invasive SA management. Steve _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Fri Nov 02 18:04:54 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io4Yr-0008TS-7R; Fri, 02 Nov 2007 18:00:17 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Io4Yp-0008SV-G7 for ipsec-confirm+ok@megatron.ietf.org; Fri, 02 Nov 2007 18:00:15 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io4Yp-0008RQ-68 for ipsec@ietf.org; Fri, 02 Nov 2007 18:00:15 -0400 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Io4Yj-0002P1-L6 for ipsec@ietf.org; Fri, 02 Nov 2007 18:00:15 -0400 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lA2M00GI020665 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 3 Nov 2007 00:00:00 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lA2DiEK8009079; Fri, 2 Nov 2007 15:44:14 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18219.10670.837747.9511@fireball.kivinen.iki.fi> Date: Fri, 2 Nov 2007 15:44:14 +0200 From: Tero Kivinen To: "Narayanan, Vidya" In-Reply-To: References: X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 5 min X-Total-Time: 5 min X-Spam-Score: 0.4 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Cc: ipsec@ietf.org, mobike@machshav.com Subject: [IPsec] [Mobike] TS updates in MOBIKE X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Narayanan, Vidya writes: > RFC4555 only allows updates to tunnel endpoint addresses and not > selectors, etc. Yes, as that was outside the charter of the mobike. > Does anyone know why TS updates are not permitted? It is already done by the IKEv2 protocol, with fast and efficient exchange called CREATE_CHILD_SA... I.e. if you need it simply, create new SA with new traffic selectors, and delete the old one. > If MOBIKE allowed what an SA rekey would allow, what is the problem? All traffic going through the SA would usually stop, as it would not know it needs to change the IP addresses, thus it would still be using the original addresses, and it wouldn't fit to the new SA. I.e. as the idea is that the for example TCP streams running inside the IPsec SA using mobike, keeps exactly same IP addresses all the time, so the TCP do not notice the movement at all. When outer addresses change, the inner addresses stay same, and TCP will only see those inner addresses it will stay happy. If those inner addresses would change then TCP streams running on old addresses would be broken and connections would be lost unless the TCP stack was also modified to update the addresses. So in mobike case there is no need to update the inner addresses, and if someone makes some real world scenario where such thing is needed CREATE_CHILD_SA will solve the problem for him... -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From MaribrevetJernigan@chevronfcu.org Fri Nov 02 18:36:26 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io57q-0002cw-6X; Fri, 02 Nov 2007 18:36:26 -0400 Received: from 186-215.186-72.tampabay.res.rr.com ([72.186.215.186] helo=mara.tampabay.rr.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Io57k-0005E7-T8; Fri, 02 Nov 2007 18:36:21 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host10021711.chevronfcu.org (8.13.1/8.13.1) with SMTP id n3wue6tF68.724349.Vut.UTE.9465794306355 for ; Fri, 2 Nov 2007 17:35:49 +0600 Message-ID: <27b4d01c81da0$beadc050$6601a8c0@mara> From: "James Barnhart" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_27B49_01C81DA0.BEADC050-- From Mikaela@scottish-music-direct.com Fri Nov 02 21:27:58 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io7nq-0005VO-9v for ipsec-archive@lists.ietf.org; Fri, 02 Nov 2007 21:27:58 -0400 Received: from host81-62-static.72-81-b.business.telecomitalia.it ([81.72.62.81]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Io7na-0003PK-Ds for ipsec-archive@lists.ietf.org; Fri, 02 Nov 2007 21:27:42 -0400 Received: from pm ([146.184.167.132]:12297 "EHLO pm" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by host81-62-static.72-81-b.business.telecomitalia.it with ESMTP id S22DDTYCHSXACGRA (ORCPT ); Sat, 3 Nov 2007 02:31:02 +0100 Message-ID: <37BC77AA.777C2B4E@scottish-music-direct.com> Date: Sat, 3 Nov 2007 02:30:38 +0100 From: "Mikaela inaltek" User-Agent: Thunderbird 1.5.0.10 (Windows/20070221) MIME-Version: 1.0 To: ipsec-archive@lists.ietf.org Subject: suoinygy Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 4.8 (++++) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea Hello Society ipsec-archive dont give up, you still have time to enlarge your penis size http://filmwiwe.com/ Mikaela inaltek From DarylfrancineLucas@determineddesigns.com Fri Nov 02 22:06:51 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Io8PS-00039a-Jd; Fri, 02 Nov 2007 22:06:50 -0400 Received: from cpe-74-76-211-17.nycap.res.rr.com ([74.76.211.17] helo=roberts) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Io8PN-0004qE-74; Fri, 02 Nov 2007 22:06:45 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host52559383.determineddesigns.com (8.13.1/8.13.1) with SMTP id 9pGVVQNx94.537526.lRT.96i.5889813057110 for ; Fri, 2 Nov 2007 22:06:24 +0500 Message-ID: From: "Enrique Craig" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_CA0EA_01C81DBE.2C2CBBA0-- From hygadvprocel@advpro.be Sat Nov 03 03:42:55 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoDeh-0006p6-Dx; Sat, 03 Nov 2007 03:42:55 -0400 Received: from user11.194.udn.pl ([82.139.11.194] helo=xhxhxhfx-207s8j.klc.vectranet.pl) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IoDeS-0001Ls-DQ; Sat, 03 Nov 2007 03:42:47 -0400 Received: from [82.139.11.194] by corclem7.parker.com; Sat, 3 Nov 2007 08:44:38 +0100 Date: Sat, 3 Nov 2007 08:44:38 +0100 From: "Raquel Fink" X-Mailer: The Bat! (v2.00) Business Reply-To: hygadvprocel@advpro.be X-Priority: 3 (Normal) Message-ID: <491845798.57750369591090@advpro.be> To: 6lowpan@lists.ietf.org Subject: Legal software sales MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------15AF29991CEDA86E" X-Spam-Score: 0.8 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca ------------15AF29991CEDA86E Content-Type: text/plain; charset=Windows-1252 Content-Transfer-Encoding: 7bit Our goal is to provide PC and Mac legal software and computer solutions of low price to fit best any budget. Whether you are a corporate buyer, a small-scale enterprise owner, or go shopping for your own home personal computer, we suppose we'll assist you. CHECK WHAT WE HAVE TO PROPOSE http://glygyhb.prooemsoft.net/ Most demanding software: *Macromedia Fireworks 8 for Mac: Retail price for today - $299.00; Our only for today - $39.95 *Microsoft Windows Vista Business: Retail price for this day - $299.00; Our just - $79.95 *Macromedia Flash Communication Server MX: Retail price now - $499.00; Our only - $29.95 *Symantec Ghost Solution Suite 2.0: Retail price today - $39.20; Our for this day - $19.95 *Microsoft OneNote 2003 Professional: Retail price for this time - $169.00; Our now - $29.95 *Symantec Norton Save & Restore 2.0: Retail price now - $49.99; Our only - $19.95 *Adobe Atmosphere 1.0: Retail price for this time - $399.00; Our only today - $29.95 *Autodesk Civil 3D 2005: Retail price for today - $5995.00; Our for this time - $69.95 COME TO US RIGHT NOW! http://glygyhb.prooemsoft.net/ ------------15AF29991CEDA86E Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit Our goal is to provide PC and Mac legal software and computer solutions of low price to fit best any budget.
Whether you are a corporate buyer, a small-scale enterprise owner,
or go shopping for your own home personal computer, we suppose we'll assist you.
CHECK WHAT WE HAVE TO PROPOSE
http://glygyhb.prooemsoft.net/
Most demanding software:
*Macromedia Fireworks 8 for Mac: Retail price for today - $299.00; Our only for today - $39.95
*Microsoft Windows Vista Business: Retail price for this day - $299.00; Our just - $79.95
*Macromedia Flash Communication Server MX: Retail price now - $499.00; Our only - $29.95
*Symantec Ghost Solution Suite 2.0: Retail price today - $39.20; Our for this day - $19.95
*Microsoft OneNote 2003 Professional: Retail price for this time - $169.00; Our now - $29.95
*Symantec Norton Save & Restore 2.0: Retail price now - $49.99; Our only - $19.95
*Adobe Atmosphere 1.0: Retail price for this time - $399.00; Our only today - $29.95
*Autodesk Civil 3D 2005: Retail price for today - $5995.00; Our for this time - $69.95
COME TO US RIGHT NOW!
http://glygyhb.prooemsoft.net/ ------------15AF29991CEDA86E-- From BarbaraconsignorMinor@jacksonwaters.com Sat Nov 03 04:02:24 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoDxY-0007aS-8s; Sat, 03 Nov 2007 04:02:24 -0400 Received: from bzq-84-108-25-1.cablep.bezeqint.net ([84.108.25.1] helo=leb226270f6975) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IoDxI-0007Rr-3Q; Sat, 03 Nov 2007 04:02:09 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host77881685.jacksonwaters.com (8.13.1/8.13.1) with SMTP id cBIc7xlg27.544713.Fog.86I.8920737397474 for ; Sat, 3 Nov 2007 10:01:33 -0200 Message-ID: From: "Maria Rouse" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_D6369_01C81DEF.CAB751A0-- From ipsec-bounces@ietf.org Sat Nov 03 08:16:36 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoHnM-0006WV-1A; Sat, 03 Nov 2007 08:08:08 -0400 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IoHnK-0006W9-KV for ipsec-confirm+ok@megatron.ietf.org; Sat, 03 Nov 2007 08:08:06 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoHnK-0006W1-9A for ipsec@ietf.org; Sat, 03 Nov 2007 08:08:06 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IoHnJ-0006l4-DZ for ipsec@ietf.org; Sat, 03 Nov 2007 08:08:06 -0400 Received: from [10.0.0.108] ([65.208.111.2]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id lA3C82m6013446 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 3 Nov 2007 05:08:04 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: Date: Sat, 3 Nov 2007 08:07:57 -0400 To: IPsec WG From: Paul Hoffman Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: d890c9ddd0b0a61e8c597ad30c1c2176 Subject: [IPsec] Fwd: Document Action: 'EAP-IKEv2 Method' to Experimental RFC X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org >The IESG has approved the following document: > >- 'EAP-IKEv2 Method ' > as an Experimental RFC > >This document has been reviewed in the IETF but is not the product of an >IETF Working Group. > >The IESG contact person is Jari Arkko. > >A URL of this Internet-Draft is: >http://www.ietf.org/internet-drafts/draft-tschofenig-eap-ikev2-15.txt > >Technical Summary > > This document specifies EAP-IKEv2, an EAP authentication method that > is based on the Internet Key Exchange (IKEv2) protocol. EAP-IKEv2 > provides mutual authentication and session key establishment between > an EAP peer and an EAP server. It supports authentication techniques > that are based on passwords, high-entropy shared keys, and public key > certificates. These techniques can be combined in a number of ways. > EAP-IKEv2 further provides support for cryptographic ciphersuite > negotiation, hash function agility, identity confidentiality (in > certain modes of operation), fragmentation, and an optional "fast > reconnect" mode. > >Working Group Summary > > There is no WG behind this proposal, but the document > has gone through discussions in the EAP WG in the past, > and has also passed Expert Review required for IANA > EAP Type code allocation. > > Responsible AD has checked with the chairs and ADs of > the EMU WG for possible conflict with their work. It > was concluded that there is no conflict. > >Protocol Quality > > Jari Arkko has reviewed this specification for the IESG. > Pasi Eronen has acted as the Expert Reviewer. There is > a research implementation of this by the authors of the > proposal. > >Note to RFC Editor > > Remove the sentence "EAP-IKEv2 has sucessfully passed Designated > Expert Review as mandated by RFC 3748." from the Abstract. > > Replace first paragraph of Section 1 with this: > > This document specifies EAP-IKEv2, an EAP method that is based on the > Internet Key Exchange Protocol version 2 (IKEv2) [1]. EAP-IKEv2 > provides mutual authentication and session key establishment between > an EAP peer and an EAP server. It supports authentication techniques > that are based on the following types of credential. > > Insert a new paragraph to Section 1 right before "The remainder > of this document ...": > > Note that the IKEv2 protocol is able to carry EAP exchanges. By > contrast, EAP-IKEv2 does not inherit this capability. That is, > it is not possible to tunnel EAP methods inside EAP-IKEv2. Also > note that the set of functionality provided by EAP-IKEv2 is similar, > but not identical, to that provided by other EAP methods such as, > for example, EAP-TLS [RFC 2716]. > > Section 8.8 first sentence should start "The Certificate > Request payload". > > Remove reference 9. > > Add an informational reference to RFF 2716. > > Replace the IANA considerations section with this: > > IANA should allocate a value for the EAP method type indicating EAP- > IKEv2. EAP-IKEv2 has already earlier sucessfully passed Designated > Expert Review as mandated by RFC 3748 for IANA allocations. > > In addition, IANA is requested to create a new registry for "EAP-IKEv2 > > > Payloads", and populate it with the following initial entries listed > below. > > The following payload type values are used by this document. > > Next Payload Type | Value > -----------------------------------+---------------------------------- > No Next payload | TBD by IANA (suggested value: 0) > Security Association payload | TBD by IANA (suggested value: 33) > Key Exchange payload | TBD by IANA (suggested value: 34) > Identification payload | > (when sent by initiator, IDi) | TBD by IANA (suggested value: 35) > Identification payload | > (when sent by responder, IDr) | TBD by IANA (suggested value: 36) > Certificate payload | TBD by IANA (suggested value: 37) > Certificate Request payload | TBD by IANA (suggested value: 38) > Authentication payload | TBD by IANA (suggested value: 39) > Nonce payload | TBD by IANA (suggested value: 40) > Notification payload | TBD by IANA (suggested value: 41) > Vendor ID payload | TBD by IANA (suggested value: 43) > Encrypted payload | TBD by IANA (suggested value: 46) > Next Fast-ID payload | TBD by IANA (suggested value: 121) > RESERVED TO IANA | 1-32, 42, 44-45, 47-120, 121-127 > PRIVATE USE | 128-255 > > Payload type values 1-120 are matching the identical payloads in the > IKEv2 IANA registry, all payload numbers not needed by EAP-IKEv2 > are left for RESERVED TO IANA. Payload numbers 121-127 are used for > EAP-IKEv2 specific payloads which are not identical to the payloads > used by IKEv2. That range has been reserved for this purpose in > IKEv2 IANA registry too. This means there will not be same payload > numbers used for different things in IKEv2 and EAP-IKEv2 protocols. > > Payload type values 121-127 are reserved to IANA for future > assignment in EAP-IKEv2 specific payloads. Payload type values > 128-255 are for private use among mutually consenting parties. > > The semantic of the above-listed payloads is provided in this > document (121-127) and refer to IKEv2 when necessary (1-120). > > New payload type values with a > description of their semantic will be assigned after Expert Review. > The expert is chosen by the IESG in consultation with the Security > Area Directors and the EMU working group chairs (or the working > group chairs of a designated successor working group). Updates > can be provided based on expert approval only. A designated > expert will be appointed by the Security Area Directors. > Based on expert approval it is possible to delete entries > from the registry or to mark entries as "deprecated". > > Each registration must include the payload type value and the > semantic of the payload. > > Please also take note of the following editorial > nits from Lars Eggert: > > INTRODUCTION, paragraph 13: > > EAP-IKEv2 has sucessfully passed Designated Expert Review as mandated > > > > > > Nit: s/sucessfully/successfully/ > > Section 1., paragraph 1: > > method does not inherit the capabilites to tunnel EAP methods inside > > Nit: s/capabilites/capabilities/ > > Section 2.14, paragraph 0: > > identifer MUST be embedded in the Encrypted payload. The > > Nit: s/identifer/identifier/ > > Section 4., paragraph 8: > > messages would be the SPI's negotiated on the previous exchange. > > Nit: s/SPI's/SPIs/ > > Section 3.2, paragraph 0: > > Reconnect-ID field contains a fast reconnect identifer that the peer > > Nit: s/identifer/identifier/ > > Section 9., paragraph 1: > > of the preceding payload. However, the identifer space from which > > Nit: s/identifer/identifier/ --Paul Hoffman, Director --VPN Consortium _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Chelsea.sangarten@kominn.no Sat Nov 03 13:54:41 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoNCj-0003jp-6P for ipsec-archive@lists.ietf.org; Sat, 03 Nov 2007 13:54:41 -0400 Received: from [190.164.34.126] (helo=[190.164.34.53]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IoNCi-0001Qs-8N for ipsec-archive@lists.ietf.org; Sat, 03 Nov 2007 13:54:40 -0400 Received: by 10.232.104.155 with SMTP id qNhuWgpBzpCNA; Sat, 3 Nov 2007 14:54:47 -0300 (GMT) Received: by 192.168.45.53 with SMTP id uIpLNAUCCisEPC.6790060699610; Sat, 3 Nov 2007 14:54:45 -0300 (GMT) Date: Sat, 3 Nov 2007 14:54:42 -0300 From: "Chelsea sangarten" Reply-To: "Chelsea sangarten" Message-ID: <714763214576.652616127623@kominn.no> To: Subject: niewhcs MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original X-Antivirus: avast! (VPS 071103-0, 03/11/2007), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 4.0 (++++) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea hello kitty baby ipsec-archive your cock will be so big, the girls will be paying you to fuck them! http://gojiream.com/ Chelsea sangarten From MorrisstilettoSoto@ifeminists.net Sat Nov 03 14:35:58 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoNqf-0006M7-N6; Sat, 03 Nov 2007 14:35:57 -0400 Received: from [88.148.88.238] (helo=usuario7ea15f3.bcs) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IoNqd-0002mp-6t; Sat, 03 Nov 2007 14:35:55 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host78904034.ifeminists.net (8.13.1/8.13.1) with SMTP id 7OQBYygW00.326841.jRL.NoY.6838484398378 for ; Sat, 3 Nov 2007 19:35:41 -0100 Message-ID: <1aad8201c81e48$606835e0$ee589458@usuario7ea15f3> From: "Alfredo Jimenez" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_1AAD7E_01C81E48.606835E0-- From otisabhijit49@abchyip.com Sat Nov 03 21:18:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoU7p-0003nl-DY for ipsec-archive@lists.ietf.org; Sat, 03 Nov 2007 21:18:05 -0400 Received: from [125.176.106.71] (helo=125.176.106.71) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IoU7o-00027U-Pd for ipsec-archive@lists.ietf.org; Sat, 03 Nov 2007 21:18:05 -0400 Received: from [125.176.106.71] by sjcexq.abchyip.com; Sun, 04 Nov 2007 01:17:56 +0000 Message-ID: <000501c81e80$0366ac69$18b2dca3@hctjyhwb> From: "den myra" To: "Carrie Lozano" Subject: exclusive watches, brand name quality rolex Date: Sat, 03 Nov 2007 23:30:34 +0000 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 4.4 (++++) X-Scan-Signature: 2870a44b67ee17965ce5ad0177e150f4 fresh presents - new models - affordable prices! http://noicagio.com/ From JaniedragLilly@preventblindness.org Sat Nov 03 23:24:43 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoW6N-0005lO-2J; Sat, 03 Nov 2007 23:24:43 -0400 Received: from 201.143.70.192.dsl.dyn.telnor.net ([201.143.70.192] helo=dorada5) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IoW6M-0007aK-5p; Sat, 03 Nov 2007 23:24:42 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by host23719131.preventblindness.org (8.13.1/8.13.1) with SMTP id eXTNNolT19.482460.tsu.teC.6223771608199 for ; Sat, 3 Nov 2007 07:25:30 -0100 Message-ID: <1aa4201c81de2$65e26790$6901a8c0@DORADA5> From: "Lynda Swartz" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_1AA3E_01C81DE2.65E26790-- From kendrick0joey@cervo.net Sun Nov 04 01:48:51 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoYLr-0007yM-EM for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 01:48:51 -0400 Received: from [212.45.19.58] (helo=212.45.19.58) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IoYLq-0006nG-Q1 for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 01:48:51 -0400 Received: from [212.45.19.58] by pnowkdw.cervo.net; Sun, 04 Nov 2007 05:48:49 +0000 Message-ID: <000601c81ea6$04e9ee86$900939bc@aycnr> From: "alano wilbur" To: "Darla Swain" Subject: We specialize in the sales of brand-name quality Date: Sun, 04 Nov 2007 04:01:27 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C81EA6.04E4E343" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 2.7 (++) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C81EA6.04E4E343 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Perfectly crafted luxury timepieces, all at affordable prices. Thousands = of different models to choose from! http://noicagio.com/ ------=_NextPart_000_0003_01C81EA6.04E4E343 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Perfectly crafted luxury timepieces, all at affordable prices. Thousands = of different models to choose from!

http://noicagio.com/ ------=_NextPart_000_0003_01C81EA6.04E4E343-- From nathanie9padma0@Newearth.cc Sun Nov 04 01:51:30 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoYOQ-0001go-4W for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 01:51:30 -0400 Received: from pool-71-175-36-117.phlapa.fios.verizon.net ([71.175.36.117]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IoYOP-0006uq-Pb for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 01:51:30 -0400 Received: from [71.175.36.117] by ngbe.Newearth.cc; Sun, 04 Nov 2007 05:51:13 +0000 Message-ID: <000701c81ea6$04dac121$64a59eab@bhjiu> From: "kinsley ches" To: "Carson Ham" Subject: Your satisfaction is guaranteed Date: Sun, 04 Nov 2007 04:03:50 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C81EA6.04D55C88" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 4.6 (++++) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 This is a multi-part message in MIME format. ------=_NextPart_000_0004_01C81EA6.04D55C88 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Perfectly crafted luxury timepieces, all at affordable prices. Thousands = of different models to choose from! http://noicagio.com/ ------=_NextPart_000_0004_01C81EA6.04D55C88 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Perfectly crafted luxury timepieces, all at affordable prices. Thousands = of different models to choose from!

http://noicagio.com/ ------=_NextPart_000_0004_01C81EA6.04D55C88-- From lspent@paralynx.com Sun Nov 04 08:14:08 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IofIm-0007Fs-CE; Sun, 04 Nov 2007 08:14:08 -0500 Received: from chello089076160079.chello.pl ([89.76.160.79]) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IofIl-0004lG-Lh; Sun, 04 Nov 2007 08:14:08 -0500 Received: from bobik ([157.165.242.148]:47311 "HELO bobik" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by 4fa04c59paralynx.com with ESMTP id 0807239651645 (ORCPT ); Sun, 4 Nov 2007 14:14:10 +0100 Message-ID: <000f01c81eec$f8191e50$01c07f7c@bobik> From: canvas the To: imapext-archive@lists.ietf.org Subject: it on weigh Date: Sun, 4 Nov 2007 14:14:10 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000C_01C81EEC.F8191E50" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.3000 X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.2869 X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 This is a multi-part message in MIME format. ------=_NextPart_000_000C_01C81EEC.F8191E50 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable peoples' senses of self and creativity. While someone is probably we could, therefor charging a much lower price. This is where the filters; = these can all be used to create a false image - one ------=_NextPart_000_000C_01C81EEC.F8191E50 Content-Type: text/html; charset="windows-1251" Content-Transfer-Encoding: quoted-printable

advertising are one the leading contributors in the continuing

Are you wa< >nting a bi< >gger p_ < >e > = n _is?

A< >s s< >een on T< >V

Over 707,000 Men arou< >nd the world are already sa< >tisfied
Gain 4+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< >p = _t< >o 21%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcises= !
*F _R< >E >< >E B< >m ot< >tles

congregate daily if they chose. It is just about as likely that
------=_NextPart_000_000C_01C81EEC.F8191E50-- From aymie@atlanticuniversitybanks.com Sun Nov 04 10:21:32 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IohI4-0005Bd-60 for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 10:21:32 -0500 Received: from softbank219215058016.bbtec.net ([219.215.58.16]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IohI3-0001Ql-Bm for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 10:21:32 -0500 Received: from aokimiho by atlanticuniversitybanks.com with ASMTP id 7B674CDD for ; Mon, 5 Nov 2007 00:22:02 +0900 Received: from aokimiho ([179.145.116.96]) by atlanticuniversitybanks.com with ESMTP id E07D0AFC4E03 for ; Mon, 5 Nov 2007 00:22:02 +0900 Message-ID: <000701c81ef6$66b86dd0$103ad7db@aokimiho> From: "aymie Thomasey" To: Subject: istavond Date: Mon, 5 Nov 2007 00:21:41 +0900 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C81F41.D6A015D0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 ------=_NextPart_000_0003_01C81F41.D6A015D0 Content-Type: text/plain; charset="shift_jis" Content-Transfer-Encoding: quoted-printable Online iPhone Screensaver - be the first to win! http://81.95.149.26/data/iphone-online.scr hello there ipsec-archive bring the spark back to your love life when you suprise her with 3 more = inches http://homdrpot.com/ aymie Thomasey ------=_NextPart_000_0003_01C81F41.D6A015D0 Content-Type: text/html; charset="shift_jis" Content-Transfer-Encoding: quoted-printable Online iPhone Screensaver - be the first to win! http://81.95.149.26/data/iphone-online.scr
hello there ipsec-archive
bring the spark back to your love life when = you suprise=20 her with 3 more inches
http://homdrpot.com/
aymie Thomasey
------=_NextPart_000_0003_01C81F41.D6A015D0-- From Rare@landwirt-vml.net Sun Nov 04 11:11:31 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ioi4R-0007t8-FO for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 11:11:31 -0500 Received: from [91.82.63.180] (helo=[91.82.63.180]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ioi4Q-0003zS-V5 for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 11:11:31 -0500 Received: from fm-6jb18v4l1aky ([151.161.14.139]:21732 "EHLO fm-6jb18v4l1aky" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by [91.82.63.180] with ESMTP id S22FEXEDFPPDZWGP (ORCPT ); Sun, 4 Nov 2007 17:12:07 +0100 Message-ID: <000601c81efd$5c2077d0$b43f525b@fm6jb18v4l1aky> From: "Rare kobel" To: ipsec-archive@lists.ietf.org Subject: larlgges Date: Sun, 4 Nov 2007 17:11:30 +0100 Message-ID: <000601c81efd$5c2077d0$b43f525b@fm6jb18v4l1aky> MIME-Version: 1.0 Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.6626 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 3.2 (+++) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea sup ipsec-archive start your next relationship with a bang and impress her with a big dick http://www.hkitguy.com/ Rare kobel From Lasekarfu@allaboutblog.com Sun Nov 04 13:55:06 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iokck-00088F-7l for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 13:55:06 -0500 Received: from ppp-43-133.33-151.iol.it ([151.33.133.43]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Iokcj-0001qF-JH for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 13:55:06 -0500 Received: by 10.38.43.104 with SMTP id vEWlBGQsoevAI; Sun, 4 Nov 2007 19:55:06 +0100 (GMT) Received: by 192.168.140.232 with SMTP id cnXQrGLrpXnymz.0952872140533; Sun, 4 Nov 2007 19:55:04 +0100 (GMT) Message-ID: <000201c81f14$341fded0$2b852197@ROBERTO> From: "GEEGEE Lasek" To: Subject: eslevreb Date: Sun, 4 Nov 2007 19:55:01 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C81F1C.95E446D0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 2.1 (++) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 ------=_NextPart_000_0007_01C81F1C.95E446D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable hi daddy ipsec-archive heres a question, are you satisfied with your penis size? http://www.hpidet.com/ GEEGEE Lasek ------=_NextPart_000_0007_01C81F1C.95E446D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
hi daddy ipsec-archive
heres a question, are you satisfied with your = penis=20 size?
http://www.hpidet.com/
GEEGEE Lasek
------=_NextPart_000_0007_01C81F1C.95E446D0-- From BrittneybylawBassett@yaleherald.com Sun Nov 04 16:57:37 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IonTM-0003qy-MX; Sun, 04 Nov 2007 16:57:36 -0500 Received: from pool-72-72-220-96.altnpa.east.verizon.net ([72.72.220.96] helo=dcdnrk71) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IonTL-0000qO-7N; Sun, 04 Nov 2007 16:57:36 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host23696721.yaleherald.com (8.13.1/8.13.1) with SMTP id MMNZIR5m00.953943.QnA.Ma4.5137627582111 for ; Sun, 4 Nov 2007 16:56:48 +0500 Message-ID: <16dd7201c81f2d$b040df50$1fa1fea9@DCDNRK71> From: "Bettie Cordero" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_16DD6E_01C81F2D.B040DF50-- From diana6lise97@c-gate.net Sun Nov 04 19:10:39 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IopY7-0002Bu-8W for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 19:10:39 -0500 Received: from 189.230.95.219.jb01-home.tm.net.my ([219.95.230.189] helo=219.95.230.189) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IopY6-0005Vq-8A for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 19:10:39 -0500 Received: from [219.95.230.189] by jsvsujmq.c-gate.net; Mon, 05 Nov 2007 00:11:04 +0000 Message-ID: <000801c81f40$01d45654$c1930793@fvwora> From: "ehud carl" To: "Joan Wood" Subject: Shop around for luxury items Date: Sun, 04 Nov 2007 22:23:42 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0005_01C81F40.01D04A04" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 4.3 (++++) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 This is a multi-part message in MIME format. ------=_NextPart_000_0005_01C81F40.01D04A04 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Perfectly crafted luxury timepieces, all at affordable prices. Thousands = of different models to choose from! http://noicagio.com/ ------=_NextPart_000_0005_01C81F40.01D04A04 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Perfectly crafted luxury timepieces, all at affordable prices. Thousands = of different models to choose from!

http://noicagio.com/ ------=_NextPart_000_0005_01C81F40.01D04A04-- From Bruntnkh@stdavidsunited.com Sun Nov 04 19:28:29 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IoppN-0002Gz-73 for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 19:28:29 -0500 Received: from [71.175.58.200] (helo=[71.175.58.200]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IoppM-0005tV-Uc for ipsec-archive@lists.ietf.org; Sun, 04 Nov 2007 19:28:29 -0500 Received: from Eagles ([134.149.57.68] helo=Eagles) by [71.175.58.200] ( sendmail 8.13.3/8.13.1) with esmtpa id 1cUpJC-000BEA-Ji for ipsec-archive@lists.ietf.org; Sun, 4 Nov 2007 19:28:44 -0500 Message-ID: <000c01c81f42$c7db4dc0$c83aaf47@Eagles> From: "nelly Brunt" To: Subject: ilebhgih Date: Sun, 4 Nov 2007 19:28:26 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C81F18.DF0545C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 0.1 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 ------=_NextPart_000_0007_01C81F18.DF0545C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello Sir ipsec-archive yesterday it was small, today its small, what will it be when you take = MANSTER? http://www.hannuty.com/ nelly Brunt ------=_NextPart_000_0007_01C81F18.DF0545C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hello Sir ipsec-archive
yesterday it was small, today its small, what = will it be=20 when you take MANSTER?
http://www.hannuty.com/
nelly Brunt
------=_NextPart_000_0007_01C81F18.DF0545C0-- From ipsec-bounces@ietf.org Sun Nov 04 21:19:11 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IorY9-0003zZ-3o; Sun, 04 Nov 2007 21:18:49 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IorY7-0003yl-UB for ipsec-confirm+ok@megatron.ietf.org; Sun, 04 Nov 2007 21:18:47 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IorY7-0003yd-Iq for ipsec@ietf.org; Sun, 04 Nov 2007 21:18:47 -0500 Received: from numenor.qualcomm.com ([129.46.51.58]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IorY6-0008EK-QN for ipsec@ietf.org; Sun, 04 Nov 2007 21:18:47 -0500 Received: from sabrina.qualcomm.com (sabrina.qualcomm.com [129.46.61.150]) by numenor.qualcomm.com (8.13.6/8.12.5/1.0) with ESMTP id lA52Hrq5019444 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sun, 4 Nov 2007 18:17:53 -0800 Received: from sanexcas01.na.qualcomm.com (sanexcas01.qualcomm.com [172.30.36.175]) by sabrina.qualcomm.com (8.13.6/8.13.6/1.0) with ESMTP id lA52HqSD026941; Sun, 4 Nov 2007 18:17:52 -0800 Received: from NAEX13.na.qualcomm.com ([129.46.51.248]) by sanexcas01.na.qualcomm.com with Microsoft SMTPSVC(6.0.3790.3959); Sun, 4 Nov 2007 18:17:52 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] RE: [Mobike] TS updates in MOBIKE Date: Sun, 4 Nov 2007 18:17:49 -0800 Message-ID: In-Reply-To: <472B7BBA.90604@certicom.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] RE: [Mobike] TS updates in MOBIKE Thread-Index: Acgdhyh46Ed7ifDcRp2Zf7CzlqGpGgByBkYg References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> From: "Narayanan, Vidya" To: "Chinh Nguyen" X-OriginalArrivalTime: 05 Nov 2007 02:17:52.0369 (UTC) FILETIME=[11A25610:01C81F52] X-Spam-Score: 0.0 (/) X-Scan-Signature: 789c141a303c09204b537a4078e2a63f Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Chinh, Steve, Tero, Thanks for all the responses. I'm just taking Chinh's email here to make a few observations.=20 > -----Original Message----- > From: Chinh Nguyen [mailto:cnguyen@certicom.com]=20 > Sent: Friday, November 02, 2007 12:34 PM > To: Narayanan, Vidya > Cc: Jari Arkko; ipsec@ietf.org; mobike@machshav.com > Subject: Re: [IPsec] RE: [Mobike] TS updates in MOBIKE >=20 > Efficiency is overrated. >=20 Well, not that overrated over licensed wireless spectrum :)=20 > But all joking aside, the UPDATE_SA notify payload is part of=20 > an informational exchange. Informationals do not contain the=20 > necessary payloads to "update an SA" such as TS, KE, and even=20 > SA payloads. >=20 Yes, that is true. I guess what I was really asking was what you were getting at immediately below.=20 > The alternative is to allow the UPDATE_SA notify payload to=20 > be part of a CREATE_CHILD_SA message. If so, it must be=20 > further specified that there are now 2 ways to UPDATE_SA: a=20 > regular end-point update via an informational, and a=20 > end-point + TS + [etc.] update via a create child sa. >=20 Yes, but, I'm not sure if that's a big deal. It is, after all, a notify payload and the processing of the payload itself doesn't change. So, in essence, we would just be lifting the mandate to only allow it to be carried in an informational exchange.=20 > Since this is a reasonably major change to the MOBIKE spec,=20 > which is already an RFC, you may need a compelling use-case scenario. >=20 The use case that I presently have in mind is the following. IPsec is used in some cases to protect Mobile IPv6 (MIP6) signaling. Some systems differentiate between trusted accesses and untrusted accesses and while IPsec is always used for MIP6 signaling protection in both cases, additional data protection using IPsec may be needed over untrusted access networks (between the same endpoints). When a mobile is moving from a trusted to untrusted access, its IP address changes, but, it also, at the same time, needs to update its SA to start protecting all traffic. At the moment, the mobile, just to handle this handoff case, needs to do a MIP6 signaling exchange, a MOBIKE exchange and a CREATE_CHILD_SA exchange. The first two are unavoidable and can happen in parallel, while the third one has to occur after the MOBIKE exchange completes. This is a latency hit in the critical path that can be avoided if the UPDATE_SA notify payload can be part of the CREATE_CHILD_SA exchange.=20 > A saving of 2 additional packets (for the extra rekey to=20 > change the TS) may not be sufficient reason to blur the=20 > current functional boundaries. >=20 Well, depending on the environment we are talking about, byte savings and particularly latency becomes important. Does the removal (or relaxing) of these tight functional boundaries really cause any issue? If not, I think allowing this can really help some use cases like the above.=20 Regards, Vidya > Chinh >=20 > -- > http://www.certicom.com >=20 > Narayanan, Vidya wrote: > > Hi Jari, > >=20 > >> -----Original Message----- > >> From: Jari Arkko [mailto:jari.arkko@piuha.net] > >> Sent: Thursday, November 01, 2007 10:26 PM > >> To: Narayanan, Vidya > >> Cc: mobike@machshav.com; ipsec@ietf.org > >> Subject: Re: [Mobike] TS updates in MOBIKE > >> > >> Presumably because MOBIKE is a mobility and multihoming=20 > facility for=20 > >> IPsec clients and gateways, i.e., you can change the outer IP=20 > >> addresses. Its not a general SA renegotiation facility. > >> > >=20 > > Yes, I understand that that is the purpose of MOBIKE. But, I don't=20 > > see a good reason to prevent other updates from happening=20 > as part of=20 > > that same exchange. For e.g., let's say that when my=20 > address changes,=20 > > I want to update the SA (or rekey) to start encrypting some=20 > additional=20 > > traffic (fitting different selector criteria) using the=20 > same SA - the=20 > > initiator now has to do separate MOBIKE and rekeying=20 > exchanges, which=20 > > is not really efficient. > >=20 > >> Yes, it could be done, but I'm not sure that's really within the=20 > >> scope of the feature. Unless we are talking about=20 > extension to deal=20 > >> with transport mode, which has been something at least a=20 > few people=20 > >> were interested in. > >> > >=20 > > I think the above point of updating the SAs applies equally to=20 > > transport and tunnel mode, but, extending MOBIKE for=20 > transport mode is=20 > > independently useful in my view. > >=20 > > Regards, > > Vidya > >=20 > >=20 > >> Jari > >> > >> Narayanan, Vidya kirjoitti: > >>> Hi, > >>> RFC4555 only allows updates to tunnel endpoint addresses and not=20 > >>> selectors, etc. Does anyone know why TS updates are not > >> permitted? =20 > >>> If MOBIKE allowed what an SA rekey would allow, what is=20 > the problem? > >>> > >>> Thanks, > >>> Vidya > >>> _______________________________________________ > >>> Mobike mailing list > >>> Mobike@machshav.com > >>> https://www.machshav.com/mailman/listinfo.cgi/mobike > >>> > >>> > >>> =20 > >=20 > >=20 > > _______________________________________________ > > IPsec mailing list > > IPsec@ietf.org > > https://www1.ietf.org/mailman/listinfo/ipsec >=20 _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Mon Nov 05 02:24:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IowJT-0006L8-CA; Mon, 05 Nov 2007 02:23:59 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IowJR-0006H7-8H for ipsec-confirm+ok@megatron.ietf.org; Mon, 05 Nov 2007 02:23:57 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IowJQ-0006Dy-JQ for ipsec@ietf.org; Mon, 05 Nov 2007 02:23:56 -0500 Received: from smtp.nokia.com ([131.228.20.171] helo=mgw-ext12.nokia.com) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IowJQ-00067s-1n for ipsec@ietf.org; Mon, 05 Nov 2007 02:23:56 -0500 Received: from esebh107.NOE.Nokia.com (esebh107.ntc.nokia.com [172.21.143.143]) by mgw-ext12.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lA57MbfJ001573; Mon, 5 Nov 2007 09:23:07 +0200 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh107.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 5 Nov 2007 09:22:57 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 5 Nov 2007 09:22:58 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Mobike] [IPsec] RE: TS updates in MOBIKE Date: Mon, 5 Nov 2007 09:22:56 +0200 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Mobike] [IPsec] RE: TS updates in MOBIKE Thread-Index: Acgdhyh46Ed7ifDcRp2Zf7CzlqGpGgByBkYgAAtBpWA= References: <472AB4D5.6050809@piuha.net><472B7BBA.90604@certicom.com> From: To: X-OriginalArrivalTime: 05 Nov 2007 07:22:58.0003 (UTC) FILETIME=[B0A46A30:01C81F7C] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Vidya Narayanan wrote: > The use case that I presently have in mind is the following. IPsec > is used in some cases to protect Mobile IPv6 (MIP6) signaling. Some > systems differentiate between trusted accesses and untrusted > accesses and while IPsec is always used for MIP6 signaling > protection in both cases, additional data protection using IPsec may > be needed over untrusted access networks (between the same > endpoints). When a mobile is moving from a trusted to untrusted > access, its IP address changes, but, it also, at the same time, > needs to update its SA to start protecting all traffic. At the > moment, the mobile, just to handle this handoff case, needs to do a > MIP6 signaling exchange, a MOBIKE exchange and a CREATE_CHILD_SA > exchange. The first two are unavoidable and can happen in parallel, > while the third one has to occur after the MOBIKE exchange > completes. This is a latency hit in the critical path that can be > avoided if the UPDATE_SA notify payload can be part of the > CREATE_CHILD_SA exchange. If the IKE implementation supports window size larger than 1, can't the Informational exchange (with UPDATE_SA notify payload) and CREATE_CHILD_SA exchange occur in parallel, too? Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From stemplejolyon63@andreasbard.com Mon Nov 05 04:11:49 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ioxzp-0000sS-Bg for ipsec-archive@lists.ietf.org; Mon, 05 Nov 2007 04:11:49 -0500 Received: from athedsl-64062.home.otenet.gr ([87.203.131.140]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ioxzo-00009A-Mq for ipsec-archive@lists.ietf.org; Mon, 05 Nov 2007 04:11:49 -0500 Received: from [87.203.131.140] by xktfphld.andreasbard.com; Mon, 05 Nov 2007 09:11:43 +0000 Message-ID: <000501c81f8b$053c7504$51c2a781@xktfphl> From: "ivor debbie" To: "Shawna Rose" Subject: perfectly crafted exclusive watches rolex Date: Mon, 05 Nov 2007 07:24:21 +0000 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 1.7 (+) X-Scan-Signature: 2870a44b67ee17965ce5ad0177e150f4 fresh presents - new models - affordable prices! http://noicagio.com/ From bind73@dimaks.com Mon Nov 05 08:33:54 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip25S-00077r-I5 for ipsec-archive@lists.ietf.org; Mon, 05 Nov 2007 08:33:54 -0500 Received: from [122.169.10.227] (helo=ABTS-mum-dynamic-227.10.169.122.airtelbroadband.in) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ip25R-0006On-L6 for ipsec-archive@lists.ietf.org; Mon, 05 Nov 2007 08:33:54 -0500 Received: from [122.169.10.227] by relay1.wplus.net; Mon, 05 Nov 2007 13:33:50 +0000 Message-ID: <000901c81fb0$02d2872e$4b7ee992@iriasd> From: "bradney kurt" To: Subject: BUY CIIALIS GENERIC, order ciialis Date: Mon, 05 Nov 2007 11:46:27 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01C81FB0.02CD3508" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 1.0 (+) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 This is a multi-part message in MIME format. ------=_NextPart_000_0006_01C81FB0.02CD3508 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable swelling of the ankles or legs; shortness of breath; prolonged or severe = dizziness; or a prolonged (lasting longer than 4 hours) or painful = erection. BUY CIIALIS GENERIC, order ciialis=20 ------=_NextPart_000_0006_01C81FB0.02CD3508 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

swelling of the ankles or legs; shortness of breath; prolonged or = severe dizziness; or a prolonged (lasting longer than 4 hours) or = painful erection.

BUY = CIIALIS GENERIC, order ciialis

------=_NextPart_000_0006_01C81FB0.02CD3508-- From ipsec-bounces@ietf.org Mon Nov 05 09:12:32 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip2gi-00038A-Si; Mon, 05 Nov 2007 09:12:24 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ip2gh-00035l-TV for ipsec-confirm+ok@megatron.ietf.org; Mon, 05 Nov 2007 09:12:23 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip2gh-00034f-8c for ipsec@ietf.org; Mon, 05 Nov 2007 09:12:23 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ip2gg-0007fL-Oh for ipsec@ietf.org; Mon, 05 Nov 2007 09:12:23 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lA5EC9Zs011927 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 5 Nov 2007 16:12:09 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lA5EC6fl013090; Mon, 5 Nov 2007 16:12:06 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18223.9398.444891.399526@fireball.kivinen.iki.fi> Date: Mon, 5 Nov 2007 16:12:06 +0200 From: Tero Kivinen To: "Narayanan, Vidya" Subject: RE: [IPsec] RE: [Mobike] TS updates in MOBIKE In-Reply-To: References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 6 min X-Total-Time: 6 min X-Spam-Score: -1.4 (-) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Narayanan, Vidya writes: > The use case that I presently have in mind is the following. IPsec is > used in some cases to protect Mobile IPv6 (MIP6) signaling. Some > systems differentiate between trusted accesses and untrusted accesses > and while IPsec is always used for MIP6 signaling protection in both > cases, additional data protection using IPsec may be needed over > untrusted access networks (between the same endpoints). When a mobile > is moving from a trusted to untrusted access, its IP address changes, > but, it also, at the same time, needs to update its SA to start > protecting all traffic. At the moment, the mobile, just to handle this > handoff case, needs to do a MIP6 signaling exchange, a MOBIKE exchange > and a CREATE_CHILD_SA exchange. The first two are unavoidable and can > happen in parallel, while the third one has to occur after the MOBIKE > exchange completes. This is a latency hit in the critical path that can > be avoided if the UPDATE_SA notify payload can be part of the > CREATE_CHILD_SA exchange. Why it cannot happen in paralleal with UPDATE_SA exchange? IKEv2 already has mechanisms defined for using bigger window for IKEv2, so you just need to enable using of window size of 2 or larger in the IKEv2, to be able to do UPDATE_SA and CREATE_CHILD_SA in paralleal, thus now latency hit at all. Or is there some other reason they cannot be done in paralleal? > Well, depending on the environment we are talking about, byte savings > and particularly latency becomes important. There is no latency problem, so the only problem is the extra 80 bytes sent and received. > Does the removal (or relaxing) of these tight functional boundaries > really cause any issue? If not, I think allowing this can really > help some use cases like the above. As there is already efficient ways to do that in the IKEv2, I do not see any reason to add another different way to get the same results only to save 160 bytes every time transition from trusted to untrusted network happens (most likely at maximum few times per day...) -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Rimas@compromisosurbanos.com Mon Nov 05 10:20:51 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip3kx-0003mL-G3 for ipsec-archive@lists.ietf.org; Mon, 05 Nov 2007 10:20:51 -0500 Received: from nat-go2-1.aster.pl ([212.76.37.182]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ip3kw-0000yH-Vw for ipsec-archive@lists.ietf.org; Mon, 05 Nov 2007 10:20:51 -0500 Received: from kaida-jgepvyej7 ([195.126.76.165] helo=kaida-jgepvyej7) by [212.76.37.182] ( sendmail 8.13.3/8.13.1) with esmtpa id 1zyDce-000RUD-tu for ipsec-archive@lists.ietf.org; Mon, 5 Nov 2007 16:21:10 +0100 Message-ID: <000e01c81fbf$71580e70$b6254cd4@kaidajgepvyej7> From: "Rimas Radisich" To: Subject: swelter1 Date: Mon, 5 Nov 2007 16:20:48 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0005_01C81FC7.D31C7670" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 1.8 (+) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 ------=_NextPart_000_0005_01C81FC7.D31C7670 Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable hola ipsec-archive because it needs to be stiff every time, you need virility pills http://isvst.com/ Rimas Radisich ------=_NextPart_000_0005_01C81FC7.D31C7670 Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable
hola ipsec-archive
because it needs to be stiff every time, you = need=20 virility pills
http://isvst.com/
Rimas Radisich
------=_NextPart_000_0005_01C81FC7.D31C7670-- From MalindapasserbyWu@llrx.com Mon Nov 05 11:35:13 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip4uv-0000Ad-7R; Mon, 05 Nov 2007 11:35:13 -0500 Received: from pool-71-106-5-48.lsanca.dsl-w.verizon.net ([71.106.5.48] helo=computer2.myhome.westell.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ip4uu-0002jY-KR; Mon, 05 Nov 2007 11:35:12 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host76375009.llrx.com (8.13.1/8.13.1) with SMTP id lOAatSi493.079859.kzH.uSt.8437112067633 for ; Mon, 5 Nov 2007 08:33:51 +0800 Message-ID: <30ad401c81fc9$ade56a40$2701a8c0@COMPUTER2> From: "Eve Lusk" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_30AD0_01C81FC9.ADE56A40-- From bspose@hnon.com Mon Nov 05 11:57:01 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip5G1-0000ao-Bh; Mon, 05 Nov 2007 11:57:01 -0500 Received: from 79.162.unknown.vectranet.pl ([88.156.162.79]) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ip5G0-0003ay-EY; Mon, 05 Nov 2007 11:57:01 -0500 Received: from piotrek3d1c5d1 ([76.48.5.59]:2212 "HELO piotrek3d1c5d1" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by 4fa29c58hnon.com with ESMTP id D032520105733 (ORCPT ); Mon, 5 Nov 2007 17:59:24 +0100 Message-ID: <001c01c81fd5$9993bb30$066bd52c@piotrek3d1c5d1> From: companion he To: iporpr-archive@lists.ietf.org Subject: an largo Date: Mon, 5 Nov 2007 17:59:24 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0019_01C81FD5.9993BB30" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.0000 X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.1409 X-Spam-Score: 3.7 (+++) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 This is a multi-part message in MIME format. ------=_NextPart_000_0019_01C81FD5.9993BB30 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable have most definitely made an impact in this industry, whether its act truly human. Without it, and others, social interaction feels computing= program. I figured they were far more trouble than they ------=_NextPart_000_0019_01C81FD5.9993BB30 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

cohesion of information from all the countries of the world. In

Are you wa< >nting a bi< >gger p_ < >e > n= _is?

A< >s s< >een on T< >V

Over 761,000 Men arou< >nd the world are already sa< >tisfied
Gain 2+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< >= p _t< >o 21%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcises! =
*F _R< >E >< >E B< >m ot< >tles

computer screen, how would our perception of artificial image
------=_NextPart_000_0019_01C81FD5.9993BB30-- From ipsec-bounces@ietf.org Mon Nov 05 15:02:31 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip89P-0003ts-Ux; Mon, 05 Nov 2007 15:02:23 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ip89P-0003s6-5J for ipsec-confirm+ok@megatron.ietf.org; Mon, 05 Nov 2007 15:02:23 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip89O-0003rx-Rw for ipsec@ietf.org; Mon, 05 Nov 2007 15:02:22 -0500 Received: from mail.ca.certicom.com ([38.113.160.197]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ip89N-0000az-KZ for ipsec@ietf.org; Mon, 05 Nov 2007 15:02:22 -0500 Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id 4253610027FE3; Mon, 5 Nov 2007 15:02:19 -0500 (EST) Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm.certicom.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dyz3ggegnEdr; Mon, 5 Nov 2007 15:02:17 -0500 (EST) Received: from domino1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP; Mon, 5 Nov 2007 15:02:17 -0500 (EST) Received: from [10.24.0.104] ([10.24.0.104]) by domino1.certicom.com (Lotus Domino Release 7.0.2FP2 HF177) with ESMTP id 2007110515015539-203613 ; Mon, 5 Nov 2007 15:01:55 -0500 Message-ID: <472F7734.4050503@certicom.com> Date: Mon, 05 Nov 2007 15:04:04 -0500 From: Chinh Nguyen User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Tero Kivinen Subject: Re: [IPsec] RE: [Mobike] TS updates in MOBIKE References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> <18223.9398.444891.399526@fireball.kivinen.iki.fi> In-Reply-To: <18223.9398.444891.399526@fireball.kivinen.iki.fi> X-MIMETrack: Itemize by SMTP Server on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/05/2007 03:01:55 PM, Serialize by Router on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/05/2007 03:01:57 PM, Serialize complete at 11/05/2007 03:01:57 PM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Spam-Score: -0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Tero Kivinen wrote: > Narayanan, Vidya writes: >> The use case that I presently have in mind is the following. IPsec is >> used in some cases to protect Mobile IPv6 (MIP6) signaling. Some >> systems differentiate between trusted accesses and untrusted accesses >> and while IPsec is always used for MIP6 signaling protection in both >> cases, additional data protection using IPsec may be needed over >> untrusted access networks (between the same endpoints). When a mobile >> is moving from a trusted to untrusted access, its IP address changes, >> but, it also, at the same time, needs to update its SA to start >> protecting all traffic. At the moment, the mobile, just to handle this >> handoff case, needs to do a MIP6 signaling exchange, a MOBIKE exchange >> and a CREATE_CHILD_SA exchange. The first two are unavoidable and can >> happen in parallel, while the third one has to occur after the MOBIKE >> exchange completes. This is a latency hit in the critical path that can >> be avoided if the UPDATE_SA notify payload can be part of the >> CREATE_CHILD_SA exchange. > > Why it cannot happen in paralleal with UPDATE_SA exchange? IKEv2 > already has mechanisms defined for using bigger window for IKEv2, so > you just need to enable using of window size of 2 or larger in the > IKEv2, to be able to do UPDATE_SA and CREATE_CHILD_SA in paralleal, > thus now latency hit at all. Or is there some other reason they cannot > be done in paralleal? A IKEv2 peer may choose to reject a CREATE_CHILD_SA if it arrives from an "unknown" endpoint (SPIs + src/dst addresses are used to track IKEv2 exchanges). In such case, the CREATE_CHILD_SA will fail if a. the CREATE_CHILD_SA arrives before the UPDATE_SA exchange or b. the CREATE_CHILD_SA arrives while the peer is doing a route check to complete the UPDATE_SA exchange. However, this can be mitigated by having the IKEv2 peer use only the SPIs to track IKEv2 exchanges and ignore src/dst addresses. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Mon Nov 05 15:30:22 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip8aO-0001gL-Cq; Mon, 05 Nov 2007 15:30:16 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ip5Qm-0003KM-Pm for ipsec-confirm+ok@megatron.ietf.org; Mon, 05 Nov 2007 12:08:08 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ip5Qm-0003Io-Fm for ipsec@ietf.org; Mon, 05 Nov 2007 12:08:08 -0500 Received: from kuber.nabble.com ([216.139.236.158]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ip5Ql-0003aR-8E for ipsec@ietf.org; Mon, 05 Nov 2007 12:08:08 -0500 Received: from isper.nabble.com ([192.168.236.156]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from ) id 1Ip5Qk-0004Bk-OI for ipsec@ietf.org; Mon, 05 Nov 2007 09:08:06 -0800 Message-ID: <13591112.post@talk.nabble.com> Date: Mon, 5 Nov 2007 09:08:06 -0800 (PST) From: Zulfiqer To: ipsec@ietf.org Subject: [Ipsec] Does ipsec-tools 0.6.3 have any known issues? MIME-Version: 1.0 X-Nabble-From: msekender@hotmail.com X-Spam-Score: 1.3 (+) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 X-Mailman-Approved-At: Mon, 05 Nov 2007 15:30:14 -0500 X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0331326197==" Errors-To: ipsec-bounces@ietf.org --===============0331326197== Content-Type: multipart/alternative; boundary="----=_Part_13414_29121929.1194282486746" ------=_Part_13414_29121929.1194282486746 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi All, I am working with ipsec-tools 0.6.3 and observed that at least twice racoon restarted. But in racoon log, there is no indication at all why racoon is restarting. Is it a known issue in ipsec tools 0.6.3? Does anyone have similar experience? Is this issue fixed in later ipsec versions? If it is fixed, then could you please tell me this issue is fixed in which ipsec version? Regards. - Zulfiqer -- View this message in context: http://www.nabble.com/Does-ipsec-tools-0.6.3-have-any-known-issues--tf4752994.html#a13591112 Sent from the IETF - Ipsec mailing list archive at Nabble.com. ------=_Part_13414_29121929.1194282486746 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hi All, I am working with ipsec-tools 0.6.3 and observed that at least twice racoon restarted. But in racoon log, there is no indication at all why racoon is restarting. Is it a known issue in ipsec tools 0.6.3? Does anyone have similar experience? Is this issue fixed in later ipsec versions? If it is fixed, then could you please tell me this issue is fixed in which ipsec version? Regards. - Zulfiqer
View this message in context: Does ipsec-tools 0.6.3 have any known issues?
Sent from the IETF - Ipsec mailing list archive at Nabble.com.
------=_Part_13414_29121929.1194282486746-- --===============0331326197== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============0331326197==-- From ConraddromedaryBrock@gizmodo.com Mon Nov 05 17:03:08 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpA2F-0006J5-O1; Mon, 05 Nov 2007 17:03:07 -0500 Received: from 81.202.178.180.dyn.user.ono.com ([81.202.178.180] helo=pcadbd0997388c) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpA2F-0005uq-8L; Mon, 05 Nov 2007 17:03:07 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host03905101.gizmodo.com (8.13.1/8.13.1) with SMTP id gvK3JOCQ22.380643.Gcg.5Bs.2222870657416 for ; Mon, 5 Nov 2007 23:02:54 -0100 Message-ID: <82c801c81ff7$a62dc620$0300a8c0@pcadbd0997388c> From: "Ramiro Buchanan" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_82C4_01C81FF7.A62DC620-- From EverettetorpedoMichael@jpost.com Mon Nov 05 20:36:37 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpDMr-00079p-3P; Mon, 05 Nov 2007 20:36:37 -0500 Received: from 103-73.101-97.tampabay.res.rr.com ([97.101.73.103] helo=paulinoa204b78.tampabay.rr.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpDMq-0004Ij-Pb; Mon, 05 Nov 2007 20:36:37 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host03385105.jpost.com (8.13.1/8.13.1) with SMTP id mu5droB600.186843.iiN.2su.2448810639832 for ; Mon, 5 Nov 2007 20:35:48 +0500 Message-ID: <2a2b401c82015$633f6440$67496561@paulinoa204b78> From: "Isiah David" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_2A2B0_01C82015.633F6440-- From ipsec-bounces@ietf.org Mon Nov 05 21:26:50 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpE96-0002MD-89; Mon, 05 Nov 2007 21:26:28 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IpE94-0002HE-7r for ipsec-confirm+ok@megatron.ietf.org; Mon, 05 Nov 2007 21:26:26 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpE93-0002Gy-UR for ipsec@ietf.org; Mon, 05 Nov 2007 21:26:25 -0500 Received: from ug-out-1314.google.com ([66.249.92.173]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IpE91-0003Nd-IP for ipsec@ietf.org; Mon, 05 Nov 2007 21:26:25 -0500 Received: by ug-out-1314.google.com with SMTP id u2so3374410uge for ; Mon, 05 Nov 2007 18:26:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=d5qZ21m1Pd3da6HkF3QxGv1xychYRlRN4HUvDSxw35A=; b=tp+pKmr7aDmPvsIBMif16N5ad3extQhIxiLQUk3dBBDVmCVTM+KcT+XwWfmnLR4ptH0onFe+uLg7nfmPUSfUgBDitThVCGQX5evo074xXEHsSf0BE+0ZH/e4uJgQEgUukeEDfxZo2Tgw0iEByA1/woxIMIRoLZuEMtJGCHIHAlg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=QvALw1FhPXKe0zrscKGNKnFUYTpu0h9Wlxmqi3fR16hrtvAqvd2vY6XJ9CNAmkimsO+7Kk1m8xguT5gAONWfGSoaEShbadJN0sntWu2XvohT+V6SNzGJqa1LojWimytjrkpU/qJ05YmlK1EtezXHGtK8RRGjuQN+fM4x2/bW/QE= Received: by 10.67.116.4 with SMTP id t4mr69627ugm.1194315982592; Mon, 05 Nov 2007 18:26:22 -0800 (PST) Received: by 10.66.255.9 with HTTP; Mon, 5 Nov 2007 18:26:22 -0800 (PST) Message-ID: Date: Tue, 6 Nov 2007 10:26:22 +0800 From: "Charles Li" To: Zulfiqer , ipsec@ietf.org Subject: Re: [Ipsec] Does ipsec-tools 0.6.3 have any known issues? In-Reply-To: <13591112.post@talk.nabble.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <13591112.post@talk.nabble.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Hi, I used the ipsec-tools 0.6.3, not have this problem, now the ipsec-tools 0.7 released, so try it. And the mailing list 'ipsec-tools-devel@lists.sourceforge.net' maybe give you more help. On Nov 6, 2007 1:08 AM, Zulfiqer wrote: > Hi All, I am working with ipsec-tools 0.6.3 and observed that at least > twice racoon restarted. But in racoon log, there is no indication at all why > racoon is restarting. Is it a known issue in ipsec tools 0.6.3? Does anyone > have similar experience? Is this issue fixed in later ipsec versions? If it > is fixed, then could you please tell me this issue is fixed in which ipsec > version? Regards. - Zulfiqer > ________________________________ > View this message in context: Does ipsec-tools 0.6.3 have any known issues? > Sent from the IETF - Ipsec mailing list archive at Nabble.com. > > _______________________________________________ > IPsec mailing list > IPsec@ietf.org > https://www1.ietf.org/mailman/listinfo/ipsec > > -- Sincerely Yours, Charles Li _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From MaxwellsomewhatPace@aahoa.com Mon Nov 05 22:46:54 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpFOw-00064s-5z; Mon, 05 Nov 2007 22:46:54 -0500 Received: from [206.47.98.36] (helo=user79f653be6c) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpFOv-0007u2-Mh; Mon, 05 Nov 2007 22:46:54 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host98486462.aahoa.com (8.13.1/8.13.1) with SMTP id 8MKpz94s22.739731.3PM.iDY.7554040759640 for ; Mon, 5 Nov 2007 22:46:41 +0500 Message-ID: <1bb24201c82027$b3c6e930$6401a8c0@user79f653be6c> From: "Romeo Landry" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_1BB23E_01C82027.B3C6E930-- From ipsec-bounces@ietf.org Tue Nov 06 01:26:16 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpHsy-0002yn-Nx; Tue, 06 Nov 2007 01:26:04 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IpHsw-0002w4-TO for ipsec-confirm+ok@megatron.ietf.org; Tue, 06 Nov 2007 01:26:02 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpHsw-0002vk-IK for ipsec@ietf.org; Tue, 06 Nov 2007 01:26:02 -0500 Received: from smtp.nokia.com ([131.228.20.173] helo=mgw-ext14.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IpHss-0000A1-Vr for ipsec@ietf.org; Tue, 06 Nov 2007 01:26:02 -0500 Received: from esebh108.NOE.Nokia.com (esebh108.ntc.nokia.com [172.21.143.145]) by mgw-ext14.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lA66PHq6007527; Tue, 6 Nov 2007 08:25:41 +0200 Received: from esebh103.NOE.Nokia.com ([172.21.143.33]) by esebh108.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 6 Nov 2007 08:25:23 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh103.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 6 Nov 2007 08:25:24 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Tue, 6 Nov 2007 08:25:23 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: draft-lepinski-dh-groups-02 Thread-Index: AcggPdA5UYlCOxJGSFOgoxEY5Ki5Jw== From: To: , , X-OriginalArrivalTime: 06 Nov 2007 06:25:24.0196 (UTC) FILETIME=[D06D0A40:01C8203D] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Cc: ipsec@ietf.org Subject: [IPsec] draft-lepinski-dh-groups-02 X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Matt and Stephen, Thanks for updating the draft! In the -02 version, I think there's one part remaining that's slightly ambiguous: > Use of MODP Diffie-Hellman groups with IKEv2 is defined in > [RFC4306]. However, [RFC4306] does not specify the format of key > exchange payloads and the derivation of shared keys for ECP > Diffie-Hellman groups. For the ECP Diffie-Hellman groups defined in > this document, the key exchange payload format and shared key > derivation procedure specified in [RFC4753] MUST be used. For IKEv1, > the use of both MODP and ECP Diffie-Hellman groups is specified in > [RFC2409]. The IKEv2 text here is clear. However, the last sentence suggests that when e.g. group 19 (NIST P-192) is used with IKEv1, the KE payload format (and shared key derivation) from RFC2409 is used. This seems to conflict with RFC 4753, which specifies a different KE payload format for this group (i.e., Section 7 of RFC 4753 seems to apply to both IKEv1 and IKEv2). Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From JeanietypoShipley@canadiandriver.com Tue Nov 06 07:48:37 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpNrB-0001Fn-G8; Tue, 06 Nov 2007 07:48:37 -0500 Received: from 24-181-233-157.dhcp.oxfr.ma.charter.com ([24.181.233.157] helo=your15c8dbd1b3) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpNrB-0005bA-65; Tue, 06 Nov 2007 07:48:37 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host03959694.canadiandriver.com (8.13.1/8.13.1) with SMTP id IgqrCsQk14.729368.svJ.x75.6670044093065 for ; Tue, 6 Nov 2007 07:50:12 +0500 Message-ID: From: "Serena Jorgensen" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_E0CF1_01C82073.9F2BE100-- From ipsec-bounces@ietf.org Tue Nov 06 11:16:40 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpR6P-0008Ga-Rw; Tue, 06 Nov 2007 11:16:33 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IpPeU-00006X-2P for ipsec-confirm+ok@megatron.ietf.org; Tue, 06 Nov 2007 09:43:38 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpPeT-00006O-Nw for ipsec@ietf.org; Tue, 06 Nov 2007 09:43:37 -0500 Received: from mx11.bbn.com ([128.33.0.80]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IpPeT-0000sf-Cg for ipsec@ietf.org; Tue, 06 Nov 2007 09:43:37 -0500 Received: from mail.bbn.com ([128.33.1.19]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1IpPeS-0008NK-5B; Tue, 06 Nov 2007 09:43:36 -0500 Received: from dhcp89-089-119.bbn.com ([128.89.89.119] helo=[127.0.0.1]) by mail.bbn.com with esmtp (Exim 4.67) (envelope-from ) id 1IpPeS-0000Yx-1S; Tue, 06 Nov 2007 09:43:36 -0500 Message-ID: <47307D27.1030001@bbn.com> Date: Tue, 06 Nov 2007 09:41:43 -0500 From: Matt Lepinski Organization: BBN User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Pasi.Eronen@nokia.com References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 X-Mailman-Approved-At: Tue, 06 Nov 2007 11:16:33 -0500 Cc: ipsec@ietf.org, tim.polk@nist.gov, kent@bbn.com Subject: [IPsec] Re: draft-lepinski-dh-groups-02 X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Pasi, Thanks for catching that. I misread RFC 4753 and thought that Section 7 applied only to IKEv2, but upon re-reading that document it is clear you are correct. I think the following text would remove the ambiguity: "Use of MODP Diffie-Hellman groups with IKEv2 is defined in [RFC4306] and the use of MODP groups with IKEv1 is defined in [RFC2409]. However, in the case of ECP Diffie-Hellman groups, the format of key exchange payloads and the derivation of a shared secret has thus far been specified on a group-by-group basis. For the ECP Diffie-Hellman groups defined in this document, the key exchange payload format and shared key derivation procedure specified in [RFC4753] MUST be used (with both IKEv2 and IKEv1)." - Matt Lepinski Pasi.Eronen@nokia.com wrote: >Matt and Stephen, > >Thanks for updating the draft! In the -02 version, I think >there's one part remaining that's slightly ambiguous: > > > >>Use of MODP Diffie-Hellman groups with IKEv2 is defined in >>[RFC4306]. However, [RFC4306] does not specify the format of key >>exchange payloads and the derivation of shared keys for ECP >>Diffie-Hellman groups. For the ECP Diffie-Hellman groups defined in >>this document, the key exchange payload format and shared key >>derivation procedure specified in [RFC4753] MUST be used. For IKEv1, >>the use of both MODP and ECP Diffie-Hellman groups is specified in >>[RFC2409]. >> >> > >The IKEv2 text here is clear. However, the last sentence suggests >that when e.g. group 19 (NIST P-192) is used with IKEv1, the >KE payload format (and shared key derivation) from RFC2409 is >used. This seems to conflict with RFC 4753, which specifies >a different KE payload format for this group (i.e., Section 7 >of RFC 4753 seems to apply to both IKEv1 and IKEv2). > >Best regards, >Pasi > > > _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From SydneyfloodlightCantrell@teenink.com Tue Nov 06 13:07:39 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpSpu-0005kw-If; Tue, 06 Nov 2007 13:07:38 -0500 Received: from [200.52.74.1] (helo=mexsaplp04) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpSpt-0006hM-Hd; Tue, 06 Nov 2007 13:07:38 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host69968058.teenink.com (8.13.1/8.13.1) with SMTP id X02Q9TRI71.804802.Lru.qOu.1859158399893 for ; Tue, 6 Nov 2007 12:02:58 +0600 Message-ID: <5a7a01c8209f$4cab9020$800101df@MEXSAPLP04> From: "Marquis Travis" To: Subject: Hi Date: Tue, 6 Nov 2007 12:02:58 +0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_5A76_01C8209F.4CAB9020" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_5A76_01C8209F.4CAB9020 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_5A76_01C8209F.4CAB9020 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_5A76_01C8209F.4CAB9020-- From LillieparaxialDowney@tattiebogle.net Tue Nov 06 19:55:35 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpZCh-0000Ol-Al; Tue, 06 Nov 2007 19:55:35 -0500 Received: from pool-71-174-239-11.bstnma.fios.verizon.net ([71.174.239.11] helo=brac.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpZCh-0003OS-3V; Tue, 06 Nov 2007 19:55:35 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host55916115.tattiebogle.net (8.13.1/8.13.1) with SMTP id LaEXtmWu47.917634.4ZQ.mYH.7232778686342 for ; Tue, 6 Nov 2007 19:55:21 +0500 Message-ID: <6d9701c820d8$ea848fc0$0201a8c0@brac> From: "Minnie Stanford" To: Subject: Your health Date: Tue, 6 Nov 2007 19:55:21 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_6D93_01C820D8.EA848FC0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_6D93_01C820D8.EA848FC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_6D93_01C820D8.EA848FC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_6D93_01C820D8.EA848FC0-- From Cokerspgg@DUCKSOFT.CO.JP Tue Nov 06 20:18:39 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpZZ1-0007Fx-Hu for ipsec-archive@lists.ietf.org; Tue, 06 Nov 2007 20:18:39 -0500 Received: from [201.50.76.192] (helo=20150096177.user.veloxzone.com.br) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IpZZ1-0004O8-3v for ipsec-archive@lists.ietf.org; Tue, 06 Nov 2007 20:18:39 -0500 Received: from JAILTON ([192.113.164.29] helo=JAILTON) by 20150096177.user.veloxzone.com.br ( sendmail 8.13.3/8.13.1) with esmtpa id 1pdReJ-000TFR-lT for ipsec-archive@lists.ietf.org; Tue, 6 Nov 2007 22:19:40 -0300 Message-ID: Date: Tue, 6 Nov 2007 22:19:08 -0300 From: "Nuri Coker" User-Agent: Thunderbird 1.5.0.10 (Windows/20070221) MIME-Version: 1.0 To: ipsec-archive@lists.ietf.org Subject: derutlup Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 071106-0, 06/11/2007), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 1.5 (+) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea Great to see you again ipsec-archive It is the size of ones penis which determines success http://kirootv.com/ Nuri Coker From ipsec-bounces@ietf.org Tue Nov 06 20:31:58 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpZll-0004Qx-FP; Tue, 06 Nov 2007 20:31:49 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IpZlj-0004Qm-PJ for ipsec-confirm+ok@megatron.ietf.org; Tue, 06 Nov 2007 20:31:47 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpZlj-0004QY-Fc for ipsec@ietf.org; Tue, 06 Nov 2007 20:31:47 -0500 Received: from ithilien.qualcomm.com ([129.46.51.59]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IpZlf-0000YU-Sq for ipsec@ietf.org; Tue, 06 Nov 2007 20:31:47 -0500 Received: from totoro.qualcomm.com (totoro.qualcomm.com [129.46.61.158]) by ithilien.qualcomm.com (8.13.6/8.12.5/1.0) with ESMTP id lA71Vd1o014790 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 6 Nov 2007 17:31:39 -0800 Received: from sanexcas01.na.qualcomm.com (sanexcas01.qualcomm.com [172.30.36.175]) by totoro.qualcomm.com (8.13.6/8.13.6/1.0) with ESMTP id lA71VZBE021733; Tue, 6 Nov 2007 17:31:35 -0800 (PST) Received: from NAEX13.na.qualcomm.com ([129.46.51.248]) by sanexcas01.na.qualcomm.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 6 Nov 2007 17:31:35 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] RE: [Mobike] TS updates in MOBIKE Date: Tue, 6 Nov 2007 17:31:33 -0800 Message-ID: In-Reply-To: <472F7734.4050503@certicom.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] RE: [Mobike] TS updates in MOBIKE Thread-Index: Acgf5syB0YfBqdo9TNOEfZ7KUUGM3QA9o6Xw References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> <18223.9398.444891.399526@fireball.kivinen.iki.fi> <472F7734.4050503@certicom.com> From: "Narayanan, Vidya" To: "Chinh Nguyen" , "Tero Kivinen" X-OriginalArrivalTime: 07 Nov 2007 01:31:35.0452 (UTC) FILETIME=[EF49EDC0:01C820DD] X-Spam-Score: -4.0 (----) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org > >=20 > > Why it cannot happen in paralleal with UPDATE_SA exchange? IKEv2=20 > > already has mechanisms defined for using bigger window for=20 > IKEv2, so=20 > > you just need to enable using of window size of 2 or larger in the=20 > > IKEv2, to be able to do UPDATE_SA and CREATE_CHILD_SA in paralleal,=20 > > thus now latency hit at all. Or is there some other reason=20 > they cannot=20 > > be done in paralleal? >=20 > A IKEv2 peer may choose to reject a CREATE_CHILD_SA if it=20 > arrives from an "unknown" endpoint (SPIs + src/dst addresses=20 > are used to track IKEv2 exchanges). In such case, the=20 > CREATE_CHILD_SA will fail if a. the CREATE_CHILD_SA arrives=20 > before the UPDATE_SA exchange or b. the CREATE_CHILD_SA=20 > arrives while the peer is doing a route check to complete the=20 > UPDATE_SA exchange. >=20 Yes, this is what I was getting at. =20 > However, this can be mitigated by having the IKEv2 peer use=20 > only the SPIs to track IKEv2 exchanges and ignore src/dst addresses. >=20 This gives the impression that the IP address to which the IKE_SA is tied is not important. That is the address that is going to serve as the tunnel endpoint for tunnel mode SAs and hence, has some consequence. I would think that typical implementations reject CREATE_CHILD_SA requests for rekeying an SA, sent from a different IP address than to which the IKE_SA is currently tied - is that not true? RFC4306 is not clear about this.=20 Thanks, Vidya _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Wed Nov 07 03:05:41 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ipfuh-0007QX-21; Wed, 07 Nov 2007 03:05:27 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ipfuf-0007NO-NY for ipsec-confirm+ok@megatron.ietf.org; Wed, 07 Nov 2007 03:05:25 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ipfua-0007Lk-Oh for ipsec@ietf.org; Wed, 07 Nov 2007 03:05:20 -0500 Received: from smtp.nokia.com ([131.228.20.171] helo=mgw-ext12.nokia.com) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IpfuZ-0003Jq-OG for ipsec@ietf.org; Wed, 07 Nov 2007 03:05:20 -0500 Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-ext12.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lA784u2n030892; Wed, 7 Nov 2007 10:05:06 +0200 Received: from esebh103.NOE.Nokia.com ([172.21.143.33]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 7 Nov 2007 10:04:55 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh103.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 7 Nov 2007 10:04:55 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] Re: draft-lepinski-dh-groups-02 Date: Wed, 7 Nov 2007 10:04:54 +0200 Message-ID: In-Reply-To: <47307D27.1030001@bbn.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] Re: draft-lepinski-dh-groups-02 Thread-Index: AcggkHq4EA41KTynSn2tcP1E4WoU6AAg8t3w References: <47307D27.1030001@bbn.com> From: To: X-OriginalArrivalTime: 07 Nov 2007 08:04:55.0509 (UTC) FILETIME=[E204D850:01C82114] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 Cc: ipsec@ietf.org, tim.polk@nist.gov, kent@bbn.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Matt, This text (also present in -03 submitted yesterday --=20 that was quick!) looks good, and removes the ambiguity. Best regards, Pasi > -----Original Message----- > From: ext Matt Lepinski [mailto:mlepinski@bbn.com]=20 > Sent: 06 November, 2007 16:42 > To: Eronen Pasi (Nokia-NRC/Helsinki) > Cc: ipsec@ietf.org; tim.polk@nist.gov; kent@bbn.com > Subject: [IPsec] Re: draft-lepinski-dh-groups-02 >=20 > Pasi, >=20 > Thanks for catching that. I misread RFC 4753 and thought that=20 > Section 7=20 > applied only to IKEv2, but upon re-reading that document it=20 > is clear you=20 > are correct. >=20 > I think the following text would remove the ambiguity: >=20 > "Use of MODP Diffie-Hellman groups with IKEv2 is defined in > [RFC4306] and the use of MODP groups with IKEv1 is defined in=20 > [RFC2409]. > However, in the case of ECP Diffie-Hellman groups, > the format of key exchange payloads and the derivation of a shared=20 > secret has thus far been > specified on a group-by-group basis. For the ECP=20 > Diffie-Hellman groups=20 > defined in > this document, the key exchange payload format and shared key > derivation procedure specified in [RFC4753] MUST be used (with both=20 > IKEv2 and IKEv1)." >=20 > - Matt Lepinski >=20 >=20 > Pasi.Eronen@nokia.com wrote: >=20 > >Matt and Stephen, > > > >Thanks for updating the draft! In the -02 version, I think > >there's one part remaining that's slightly ambiguous: > > > > =20 > > > >>Use of MODP Diffie-Hellman groups with IKEv2 is defined in > >>[RFC4306]. However, [RFC4306] does not specify the format of key > >>exchange payloads and the derivation of shared keys for ECP > >>Diffie-Hellman groups. For the ECP Diffie-Hellman groups defined in > >>this document, the key exchange payload format and shared key > >>derivation procedure specified in [RFC4753] MUST be used. For IKEv1, > >>the use of both MODP and ECP Diffie-Hellman groups is specified in > >>[RFC2409]. > >> =20 > >> > > > >The IKEv2 text here is clear. However, the last sentence suggests > >that when e.g. group 19 (NIST P-192) is used with IKEv1, the > >KE payload format (and shared key derivation) from RFC2409 is > >used. This seems to conflict with RFC 4753, which specifies > >a different KE payload format for this group (i.e., Section 7 > >of RFC 4753 seems to apply to both IKEv1 and IKEv2). > > > >Best regards, > >Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From TonyevenhandedOrtiz@suburbanchicagonews.com Wed Nov 07 03:15:38 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ipg4Y-0007x0-5O; Wed, 07 Nov 2007 03:15:38 -0500 Received: from pool-71-120-25-15.washdc.east.verizon.net ([71.120.25.15] helo=sewell6) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ipg4X-0003fD-KL; Wed, 07 Nov 2007 03:15:38 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host01300128.suburbanchicagonews.com (8.13.1/8.13.1) with SMTP id aCsL9Du823.814665.4Ft.rl2.1424102302192 for ; Wed, 7 Nov 2007 03:15:23 +0500 Message-ID: <26b7801c82116$636500e0$0f197847@Sewell6> From: "Jeff Reynolds" To: Subject: Approval process Date: Wed, 7 Nov 2007 03:15:23 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_26B74_01C82116.636500E0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_26B74_01C82116.636500E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_26B74_01C82116.636500E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_26B74_01C82116.636500E0-- From ipsec-bounces@ietf.org Wed Nov 07 04:48:19 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IphW5-0002YP-BB; Wed, 07 Nov 2007 04:48:09 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IphW3-0002Vx-DP for ipsec-confirm+ok@megatron.ietf.org; Wed, 07 Nov 2007 04:48:07 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IphW3-0002Vp-0Y for ipsec@ietf.org; Wed, 07 Nov 2007 04:48:07 -0500 Received: from smtp.nokia.com ([131.228.20.172] helo=mgw-ext13.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IphVz-0000oK-C1 for ipsec@ietf.org; Wed, 07 Nov 2007 04:48:06 -0500 Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-ext13.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lA79lqwL006908; Wed, 7 Nov 2007 11:47:53 +0200 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 7 Nov 2007 11:47:08 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 7 Nov 2007 11:47:08 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] RE: [Mobike] TS updates in MOBIKE Date: Wed, 7 Nov 2007 11:47:07 +0200 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] RE: [Mobike] TS updates in MOBIKE Thread-Index: Acgf5syB0YfBqdo9TNOEfZ7KUUGM3QA9o6XwABFShoA= References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> <18223.9398.444891.399526@fireball.kivinen.iki.fi><472F7734.4050503@certicom.com> From: To: X-OriginalArrivalTime: 07 Nov 2007 09:47:08.0904 (UTC) FILETIME=[29CEA680:01C82123] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Vidya Narayanan wrote: > This gives the impression that the IP address to which the IKE_SA is > tied is not important. That is the address that is going to serve > as the tunnel endpoint for tunnel mode SAs and hence, has some > consequence. I would think that typical implementations reject > CREATE_CHILD_SA requests for rekeying an SA, sent from a different > IP address than to which the IKE_SA is currently tied - is that not > true? RFC4306 is not clear about this. We faced this question when designing MOBIKE, and resolved it as follows (RFC 4555, Section 3.3): When an IPsec SA is created, the tunnel header IP addresses (and port, if doing UDP encapsulation) are taken from the IKE_SA, not the IP header of the IKEv2 message requesting the IPsec SA. The addresses in the IKE_SA are initialized from the IP header of the first IKE_AUTH request. In other words: the CREATE_CHILD_SA request is not rejected, and=20 the reply is still sent back to the address the packet came from; but the tunnel endpoints are initialized from stored information (which can be updated by UPDATE_SA_ADDRESSES). Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec@freeswan.org Wed Nov 07 07:50:17 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpkML-0005pt-8z for ipsec-archive@lists.ietf.org; Wed, 07 Nov 2007 07:50:17 -0500 Received: from [122.161.121.225] (helo=ABTS-NCR-Dynamic-225.121.161.122.airtelbroadband.in) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpkMJ-00058i-Vw for ipsec-archive@lists.ietf.org; Wed, 07 Nov 2007 07:50:17 -0500 Received: from Boris Mcnamara (10.13.11.19) by ABTS-NCR-Dynamic-225.121.161.122.airtelbroadband.in (PowerMTA(TM) v3.2r4) id hfp01o87d61j05 for ; Wed, 7 Nov 2007 06:20:12 -0800 Message-Id: <20071107-22012.2676.qmail@ABTS-NCR-Dynamic-225.121.161.122.airtelbroadband.in> To: Subject: November 72% OFF From: VIAGRA ® Official Site MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Spam-Score: 4.5 (++++) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8
From prudencedonald17@butler-bremer.com Wed Nov 07 08:04:34 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpkaA-0006VH-E8 for ipsec-archive@lists.ietf.org; Wed, 07 Nov 2007 08:04:34 -0500 Received: from hgz-kwd-2866d.adsl.wanadoo.nl ([83.116.36.109]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ipka9-0005uf-UQ for ipsec-archive@lists.ietf.org; Wed, 07 Nov 2007 08:04:34 -0500 Received: from [83.116.36.109] by mjqeyvlh.butler-bremer.com; Wed, 07 Nov 2007 13:05:11 +0000 Message-ID: <000801c8213e$0344d4e6$92b6be9f@ptnwme> From: "godwin manfred" To: "Alden Fournier" Subject: perfectly crafted exclusive watches rolex Date: Wed, 07 Nov 2007 11:17:49 +0000 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 1.7 (+) X-Scan-Signature: 2870a44b67ee17965ce5ad0177e150f4 fresh presents - new models - affordable prices! http://webreplecroc.com/ From ipsec-bounces@ietf.org Wed Nov 07 09:13:17 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ipldq-0004Eq-JL; Wed, 07 Nov 2007 09:12:26 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ipldo-0004Ct-JR for ipsec-confirm+ok@megatron.ietf.org; Wed, 07 Nov 2007 09:12:24 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ipldn-0004Cl-UN for ipsec@ietf.org; Wed, 07 Nov 2007 09:12:23 -0500 Received: from fireball.acr.fi ([83.145.195.1] helo=mail.kivinen.iki.fi) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ipldn-00011k-Cx for ipsec@ietf.org; Wed, 07 Nov 2007 09:12:23 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lA7ECBXN011948 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 7 Nov 2007 16:12:11 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lA7EC7ux001481; Wed, 7 Nov 2007 16:12:07 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18225.51127.907222.10175@fireball.kivinen.iki.fi> Date: Wed, 7 Nov 2007 16:12:07 +0200 From: Tero Kivinen To: Chinh Nguyen Subject: Re: [IPsec] RE: [Mobike] TS updates in MOBIKE In-Reply-To: <472F7734.4050503@certicom.com> References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> <18223.9398.444891.399526@fireball.kivinen.iki.fi> <472F7734.4050503@certicom.com> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 5 min X-Total-Time: 4 min X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Chinh Nguyen writes: > A IKEv2 peer may choose to reject a CREATE_CHILD_SA if it arrives from > an "unknown" endpoint (SPIs + src/dst addresses are used to track IKEv2 > exchanges). In such case, the CREATE_CHILD_SA will fail if a. the > CREATE_CHILD_SA arrives before the UPDATE_SA exchange or b. the > CREATE_CHILD_SA arrives while the peer is doing a route check to > complete the UPDATE_SA exchange. With proper mobike implementations there should not be any such problems. The outer addresses should not be used for policy enforcements, as it is using valid IKE SA to send that CREATE_CHILD_SA. If the CREATE_CHILD_SA arrives while doing return routability check, that should not cause any problems either. > However, this can be mitigated by having the IKEv2 peer use only the > SPIs to track IKEv2 exchanges and ignore src/dst addresses. If you are using mobike, you do ingore outer src/dst addresses anyways (or at least do not use them to enforce any kind of policy, you of course use them to detect movement etc). -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Wed Nov 07 09:57:47 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpmLf-0008Mo-Fn; Wed, 07 Nov 2007 09:57:43 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IpmLe-0008M3-5O for ipsec-confirm+ok@megatron.ietf.org; Wed, 07 Nov 2007 09:57:42 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpmLd-0008Lu-S2 for ipsec@ietf.org; Wed, 07 Nov 2007 09:57:41 -0500 Received: from mail.ca.certicom.com ([38.113.160.197]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IpmLa-0003h2-Gx for ipsec@ietf.org; Wed, 07 Nov 2007 09:57:41 -0500 Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id 3D53E10027FE5; Wed, 7 Nov 2007 09:57:38 -0500 (EST) Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm.certicom.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iOUCcG1oKKgH; Wed, 7 Nov 2007 09:57:36 -0500 (EST) Received: from domino1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP; Wed, 7 Nov 2007 09:57:36 -0500 (EST) Received: from [10.24.0.104] ([10.24.0.104]) by domino1.certicom.com (Lotus Domino Release 7.0.2FP2 HF177) with ESMTP id 2007110709571418-211767 ; Wed, 7 Nov 2007 09:57:14 -0500 Message-ID: <4731D2CB.7010801@certicom.com> Date: Wed, 07 Nov 2007 09:59:23 -0500 From: Chinh Nguyen User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: "Narayanan, Vidya" Subject: Re: [IPsec] RE: [Mobike] TS updates in MOBIKE References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> <18223.9398.444891.399526@fireball.kivinen.iki.fi> <472F7734.4050503@certicom.com> In-Reply-To: X-MIMETrack: Itemize by SMTP Server on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/07/2007 09:57:14 AM, Serialize by Router on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/07/2007 09:57:15 AM, Serialize complete at 11/07/2007 09:57:15 AM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Spam-Score: -0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Cc: ipsec@ietf.org, mobike@machshav.com, Tero Kivinen X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org >> However, this can be mitigated by having the IKEv2 peer use >> only the SPIs to track IKEv2 exchanges and ignore src/dst addresses. >> > > This gives the impression that the IP address to which the IKE_SA is > tied is not important. That is the address that is going to serve as > the tunnel endpoint for tunnel mode SAs and hence, has some consequence. > I would think that typical implementations reject CREATE_CHILD_SA > requests for rekeying an SA, sent from a different IP address than to > which the IKE_SA is currently tied - is that not true? RFC4306 is not > clear about this. From a MOBIKE view, IKE_SA cannot be tied to IP addresses. The entire premise of an UPDATE_SA is that it may originate from a new endpoint, different from the endpoints stored in the current IKE_SA. As such, a MOBIKE peer should allow this for all IKEv2 exchanges, including CREATE_CHILD_SA (as noted by Pasi RFC 4555 section 3.3). Whether or not a non-MOBIKE IKEv2 implementation should do the same is another question. I vote for yes as the SPIs and successful authentication/decryption (correct IKE_SA) is sufficient to validate "peer identity". _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Wed Nov 07 17:01:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ipsxa-0002dn-9M; Wed, 07 Nov 2007 17:01:18 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IpsxX-0002XG-3o for ipsec-confirm+ok@megatron.ietf.org; Wed, 07 Nov 2007 17:01:15 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpsxW-0002X0-OX for ipsec@ietf.org; Wed, 07 Nov 2007 17:01:14 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IpsxW-0004P6-9D for ipsec@ietf.org; Wed, 07 Nov 2007 17:01:14 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lA7M00jO007066 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 8 Nov 2007 00:00:28 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lA7EO3bU028620; Wed, 7 Nov 2007 16:24:03 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18225.51843.197031.515912@fireball.kivinen.iki.fi> Date: Wed, 7 Nov 2007 16:24:03 +0200 From: Tero Kivinen To: "Narayanan, Vidya" Subject: RE: [IPsec] RE: [Mobike] TS updates in MOBIKE In-Reply-To: References: <472AB4D5.6050809@piuha.net> <472B7BBA.90604@certicom.com> <18223.9398.444891.399526@fireball.kivinen.iki.fi> <472F7734.4050503@certicom.com> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 5 min X-Total-Time: 4 min X-Spam-Score: 0.4 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Cc: ipsec@ietf.org, mobike@machshav.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Narayanan, Vidya writes: > This gives the impression that the IP address to which the IKE_SA is > tied is not important. That is the address that is going to serve as > the tunnel endpoint for tunnel mode SAs and hence, has some consequence. > I would think that typical implementations reject CREATE_CHILD_SA > requests for rekeying an SA, sent from a different IP address than to > which the IKE_SA is currently tied - is that not true? RFC4306 is not > clear about this. Check the RFC4555 instead of RFC4306. With mobike all existing IPsec SAs do get updated with new outer addresses with UPDATE_SA_ADDRESSES, so it does not matter what the outer IP adresses were when the IPsec SA was created. Also it is normal operation to get packets in with different outer address to IKE SA when using MOBIKE. This happens for example when you start to do UPDATE_SA_ADDRESSES, but can happen also with any other IKEv2 packet. This is because other end might not be able to send UPDATE_SA_ADDRESSES because it first needs to finish other ongoing exchange on the IKEv2 SA in case the window size is only 1. -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From BrettmiddleburyHowell@spearsmfg.com Wed Nov 07 20:52:52 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpwZg-00088D-9u; Wed, 07 Nov 2007 20:52:52 -0500 Received: from [201.195.190.122] (helo=gonzalez.ice.co.cr) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IpwZe-0003CN-U8; Wed, 07 Nov 2007 20:52:52 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host20536645.spearsmfg.com (8.13.1/8.13.1) with SMTP id Eag7klNI41.386820.LrZ.KxJ.6767371255361 for ; Wed, 7 Nov 2007 19:51:26 +0600 Message-ID: <102ab01c821aa$086c4790$f304880a@gonzalez> From: "Andre Richards" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_102A7_01C821AA.086C4790-- From sathyanarayana_1977@vsnl.co.in Wed Nov 07 22:36:48 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IpyCG-0003M3-AU for ipsec-archive@lists.ietf.org; Wed, 07 Nov 2007 22:36:48 -0500 Received: from cm65.delta66.maxonline.com.sg ([59.189.66.65]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1IpyCD-00063p-Jq for ipsec-archive@lists.ietf.org; Wed, 07 Nov 2007 22:36:48 -0500 Received: from [217.87.138.60] (helo=cxk) by cm65.delta66.maxonline.com.sg with smtp (Exim 4.62 (FreeBSD)) id 1J›yD/-0006NW-0e; Thu, 8 Nov 2007 11:37:31 +0800 Message-ID: <000301c821b8$6735fe70$3c8a57d9@cxk> From: To: Subject: Nothing is funnier this Halloween Date: Thu, 8 Nov 2007 11:35:26 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="windows-1252"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Score: 4.9 (++++) X-Scan-Signature: 0f1ff0b0158b41ac6b9548d0972cdd31 Get the original dancing bones. http://189.4.36.253/ From JuliemuSmart@orgonics.com Thu Nov 08 20:31:33 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqIib-0002gO-IK; Thu, 08 Nov 2007 20:31:33 -0500 Received: from [201.221.147.236] (helo=crazynet3) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqIib-0006l5-2Q; Thu, 08 Nov 2007 20:31:33 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host95755388.orgonics.com (8.13.1/8.13.1) with SMTP id xWr0UUje88.062445.OLy.yVQ.5170621372607 for ; Thu, 8 Nov 2007 20:30:42 +0500 Message-ID: <52c401c82270$3dea83c0$a400a8c0@Crazynet3> From: "Marie Mackey" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_52C0_01C82270.3DEA83C0-- From JosefinaresurgentBurkett@rotax-owner.com Thu Nov 08 23:56:00 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqLuS-00019q-5Q; Thu, 08 Nov 2007 23:56:00 -0500 Received: from pool-71-186-160-119.bflony.fios.verizon.net ([71.186.160.119] helo=emily0305.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqLuR-0003wU-TW; Thu, 08 Nov 2007 23:56:00 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host24533679.rotax-owner.com (8.13.1/8.13.1) with SMTP id 60z2qPCH69.742179.dbw.2MO.3048945918193 for ; Thu, 8 Nov 2007 23:54:46 +0500 Message-ID: <55bce01c8228c$b1aa6840$0201a8c0@emily0305> From: "Sonja Wiseman" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_55BCA_01C8228C.B1AA6840-- From FrankieprecautionaryMurillo@metacritic.com Fri Nov 09 00:53:55 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqMoV-0006xT-9J; Fri, 09 Nov 2007 00:53:55 -0500 Received: from pool-72-64-53-236.nrflva.east.verizon.net ([72.64.53.236] helo=maciesroom.myhome.westell.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqMoU-0005Vf-CL; Fri, 09 Nov 2007 00:53:55 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host99002914.metacritic.com (8.13.1/8.13.1) with SMTP id kKE37HoX32.964402.ypz.gpj.8280935937175 for ; Fri, 9 Nov 2007 00:53:31 +0500 Message-ID: <31fe201c82294$e6fa0bb0$2e01a8c0@maciesroom> From: "Candy Hadley" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_31FDE_01C82294.E6FA0BB0-- From ipsec-bounces@ietf.org Fri Nov 09 05:48:55 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqRPi-0008Qk-8p; Fri, 09 Nov 2007 05:48:38 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IqRPg-0008Py-BN for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 05:48:36 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqRPg-0008Po-1X for ipsec@ietf.org; Fri, 09 Nov 2007 05:48:36 -0500 Received: from smtp.nokia.com ([131.228.20.170] helo=mgw-ext11.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IqRPb-0001gJ-Tp for ipsec@ietf.org; Fri, 09 Nov 2007 05:48:36 -0500 Received: from esebh108.NOE.Nokia.com (esebh108.ntc.nokia.com [172.21.143.145]) by mgw-ext11.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lA9AmEui018208 for ; Fri, 9 Nov 2007 12:48:28 +0200 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh108.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 9 Nov 2007 12:47:58 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 9 Nov 2007 12:47:58 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Fri, 9 Nov 2007 12:47:55 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: FWD: I-D Action:draft-eronen-ipsec-ikev2-ipv6-config-01.txt Thread-Index: Acgivfwl/vYpRdhIR8yZehs6E0/etw== From: To: X-OriginalArrivalTime: 09 Nov 2007 10:47:58.0330 (UTC) FILETIME=[FDDC5DA0:01C822BD] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Subject: [IPsec] FWD: I-D Action:draft-eronen-ipsec-ikev2-ipv6-config-01.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org FYI: I've updated the draft based on comments I've got, and the details got changed quite a bit from the -00 version.=20 I've also asked for a slot to present this in 6man WG in=20 Vancouver to get more feedback from IPv6 experts. Best regards, Pasi --------- A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : IPv6 Configuration in IKEv2 Author(s) : P. Eronen Filename : draft-eronen-ipsec-ikev2-ipv6-config-01.txt Pages : 27 Date : 2007-11-08 When IKEv2 is used for remote VPN access (client to VPN gateway), the gateway assigns the client an IP address from the internal network using IKEv2 configuration payloads. The configuration payloads specified in RFC 4306 work well for IPv4, but make it difficult to use certain features of IPv6. This document describes the limitations of current IKEv2 configuration payloads for IPv6, and explores possible solutions that would allow IKEv2 to set up full- featured virtual IPv6 interfaces. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-eronen-ipsec-ikev2-ipv6-config -01.txt _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Fri Nov 09 13:22:32 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYUl-0008Rq-O7; Fri, 09 Nov 2007 13:22:19 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IqYUk-0008If-OR for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 13:22:18 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYUk-0008H5-CJ for ipsec@ietf.org; Fri, 09 Nov 2007 13:22:18 -0500 Received: from e5.ny.us.ibm.com ([32.97.182.145]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IqYUj-0005ub-Vs for ipsec@ietf.org; Fri, 09 Nov 2007 13:22:18 -0500 Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236]) by e5.ny.us.ibm.com (8.13.8/8.13.8) with ESMTP id lA9IMHQx006214 for ; Fri, 9 Nov 2007 13:22:17 -0500 Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by d01relay04.pok.ibm.com (8.13.8/8.13.8/NCO v8.5) with ESMTP id lA9IMGfL129790 for ; Fri, 9 Nov 2007 13:22:16 -0500 Received: from d01av01.pok.ibm.com (loopback [127.0.0.1]) by d01av01.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id lA9IMGi8015199 for ; Fri, 9 Nov 2007 13:22:16 -0500 Received: from austin.ibm.com (netmail2.austin.ibm.com [9.41.248.176]) by d01av01.pok.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id lA9IMGBB015175 for ; Fri, 9 Nov 2007 13:22:16 -0500 Received: from faith.austin.ibm.com (faith.austin.ibm.com [9.53.40.35]) by austin.ibm.com (8.13.8/8.12.10) with ESMTP id lA9IMCDP043148 for ; Fri, 9 Nov 2007 12:22:16 -0600 Received: from faith.austin.ibm.com (localhost.localdomain [127.0.0.1]) by faith.austin.ibm.com (8.13.4/8.12.8) with ESMTP id lA9IHGfw012985 for ; Fri, 9 Nov 2007 12:17:16 -0600 Received: (from jml@localhost) by faith.austin.ibm.com (8.13.4/8.13.4/Submit) id lA9IHCE9012984 for ipsec@ietf.org; Fri, 9 Nov 2007 12:17:12 -0600 X-Authentication-Warning: faith.austin.ibm.com: jml set sender to latten@austin.ibm.com using -f From: Joy Latten To: ipsec@ietf.org Content-Type: text/plain Content-Transfer-Encoding: 7bit Date: Fri, 09 Nov 2007 12:17:12 -0600 Message-Id: <1194632232.2477.636.camel@faith.austin.ibm.com> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 (2.2.3-2.fc4) X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Subject: [IPsec] Use of SPD in verifying incoming packets X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org RFC 4301 Section 5.2 describes processing inbound IP traffic. After applying AH or ESP processing, the packet is matched against the selectors of SA used to verify appropriate SA was used. Then handed up to transport model, forwarded, etc.. There is no mention of SPD needing to be consulted also for this verification. RFC's 2401 description of inbound processing found in section 5.2.1 included finding an incoming policy in SPD that matched the packet as part of verification process. In rfc 4301 in section 13 describing differences from 2401, I did not see anything stating this difference. Thus I am not sure if I am interpreting correctly and would like some clarification so I'll know if I need to modify existing implementation to comply? regards, Joy _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From GracebivalveHastings@driver-repository.be Fri Nov 09 13:45:43 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYrP-0004xM-0j; Fri, 09 Nov 2007 13:45:43 -0500 Received: from dyn216-8-163-240.adsl.mnsi.net ([216.8.163.240] helo=acer47cbe8a5ed) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqYrL-0006kr-3o; Fri, 09 Nov 2007 13:45:42 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host93341944.driver-repository.be (8.13.1/8.13.1) with SMTP id IBBZHCdG74.523560.pfK.CCx.4356569628462 for ; Fri, 9 Nov 2007 13:44:19 +0500 Message-ID: <1d36901c82300$bda04ab0$6501a8c0@acer47cbe8a5ed> From: "Rosa Mcgrath" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_1D365_01C82300.BDA04AB0-- From ipsec-bounces@ietf.org Fri Nov 09 13:49:41 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYv7-0007bc-5c; Fri, 09 Nov 2007 13:49:33 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IqYv4-0007Zx-HM for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 13:49:30 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYv4-0007Zp-6q for ipsec@ietf.org; Fri, 09 Nov 2007 13:49:30 -0500 Received: from brmea-mail-1.sun.com ([192.18.98.31]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IqYv3-0006tp-CS for ipsec@ietf.org; Fri, 09 Nov 2007 13:49:29 -0500 Received: from dm-east-01.east.sun.com ([129.148.9.192]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id lA9InSe3010718 for ; Fri, 9 Nov 2007 18:49:28 GMT Received: from kebe.east.sun.com (kebe.East.Sun.COM [129.148.174.48]) by dm-east-01.east.sun.com (8.13.8+Sun/8.13.8/ENSMAIL, v2.2) with ESMTP id lA9InSLk032775 for ; Fri, 9 Nov 2007 13:49:28 -0500 (EST) Received: from kebe.east.sun.com (localhost [127.0.0.1]) by kebe.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA9IYQ9C003183; Fri, 9 Nov 2007 13:34:26 -0500 (EST) Received: (from danmcd@localhost) by kebe.east.sun.com (8.14.1+Sun/8.14.1/Submit) id lA9IY9rT003181; Fri, 9 Nov 2007 13:34:09 -0500 (EST) X-Authentication-Warning: kebe.east.sun.com: danmcd set sender to danmcd@sun.com using -f Date: Fri, 9 Nov 2007 13:34:09 -0500 From: Dan McDonald To: Joy Latten Subject: Re: [IPsec] Use of SPD in verifying incoming packets Message-ID: <20071109183409.GB3152@kebe.East.Sun.COM> References: <1194632232.2477.636.camel@faith.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1194632232.2477.636.camel@faith.austin.ibm.com> User-Agent: Mutt/1.4.2.2i Organization: Sun Microsystems, Inc. - Solaris Networking & Security X-Spam-Score: -1.0 (-) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org On Fri, Nov 09, 2007 at 12:17:12PM -0600, Joy Latten wrote: > RFC 4301 Section 5.2 describes processing inbound IP traffic. > After applying AH or ESP processing, the packet is matched against the > selectors of SA used to verify appropriate SA was used. Then > handed up to transport model, forwarded, etc.. > There is no mention of SPD needing to be consulted also for > this verification. That's gotta be an oversight. Either that, or it assumes Key Management is infallible when it comes to setting up SAs that correspond precisely with the state of the SPD. Dan _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Fri Nov 09 15:17:04 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqaHN-0001jH-Ul; Fri, 09 Nov 2007 15:16:37 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IqaHM-0001j7-U9 for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 15:16:36 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqaHM-0001gt-JH for ipsec@ietf.org; Fri, 09 Nov 2007 15:16:36 -0500 Received: from e31.co.us.ibm.com ([32.97.110.149]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IqaHK-0002oT-Ix for ipsec@ietf.org; Fri, 09 Nov 2007 15:16:34 -0500 Received: from d03relay04.boulder.ibm.com (d03relay04.boulder.ibm.com [9.17.195.106]) by e31.co.us.ibm.com (8.13.8/8.13.8) with ESMTP id lA9KGXrf002339 for ; Fri, 9 Nov 2007 15:16:33 -0500 Received: from d03av03.boulder.ibm.com (d03av03.boulder.ibm.com [9.17.195.169]) by d03relay04.boulder.ibm.com (8.13.8/8.13.8/NCO v8.5) with ESMTP id lA9KGKmS126706 for ; Fri, 9 Nov 2007 13:16:21 -0700 Received: from d03av03.boulder.ibm.com (loopback [127.0.0.1]) by d03av03.boulder.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id lA9KGKEo031348 for ; Fri, 9 Nov 2007 13:16:20 -0700 Received: from austin.ibm.com (netmail1.austin.ibm.com [9.41.248.175]) by d03av03.boulder.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id lA9KGHH6031034; Fri, 9 Nov 2007 13:16:17 -0700 Received: from faith.austin.ibm.com (faith.austin.ibm.com [9.53.40.35]) by austin.ibm.com (8.13.8/8.12.10) with ESMTP id lA9KGHCX046258; Fri, 9 Nov 2007 14:16:17 -0600 Received: from faith.austin.ibm.com (localhost.localdomain [127.0.0.1]) by faith.austin.ibm.com (8.13.4/8.12.8) with ESMTP id lA9KBLRu013552; Fri, 9 Nov 2007 14:11:21 -0600 Received: (from jml@localhost) by faith.austin.ibm.com (8.13.4/8.13.4/Submit) id lA9KBL9p013551; Fri, 9 Nov 2007 14:11:21 -0600 X-Authentication-Warning: faith.austin.ibm.com: jml set sender to latten@austin.ibm.com using -f Subject: Re: [IPsec] Use of SPD in verifying incoming packets From: Joy Latten To: Dan McDonald In-Reply-To: <20071109183409.GB3152@kebe.East.Sun.COM> References: <1194632232.2477.636.camel@faith.austin.ibm.com> <20071109183409.GB3152@kebe.East.Sun.COM> Content-Type: text/plain Content-Transfer-Encoding: 7bit Date: Fri, 09 Nov 2007 14:11:20 -0600 Message-Id: <1194639081.2477.659.camel@faith.austin.ibm.com> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 (2.2.3-2.fc4) X-Spam-Score: -4.0 (----) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org On Fri, 2007-11-09 at 13:34 -0500, Dan McDonald wrote: > On Fri, Nov 09, 2007 at 12:17:12PM -0600, Joy Latten wrote: > > RFC 4301 Section 5.2 describes processing inbound IP traffic. > > After applying AH or ESP processing, the packet is matched against the > > selectors of SA used to verify appropriate SA was used. Then > > handed up to transport model, forwarded, etc.. > > There is no mention of SPD needing to be consulted also for > > this verification. > > > That's gotta be an oversight. Either that, or it assumes Key Management is > infallible when it comes to setting up SAs that correspond precisely with the > state of the SPD. > Ok, thanks, I was wondering. But then while implementing Name selector, I thought, how would inbound ipsec packet verify against a named SPD entry? I mean, for named spd entries as described in case 1, would not the responder have a named spd entry, such that when it receives an inbound packet, it would not match... I did see the following on pages 24 & 25 in rfc 4301, If the SPD is not decorrelated, caching is not allowed and an ordered search of SPD MUST be performed to verify that inbound traffic arriving on an SA is consistent with the access control policy expressed in the SPD. However, since not mentioned in description for inbound processing, became somewhat confused. Especially when I started trying to understand how to implement named spd entries as in case 1. regards, Joy _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From MaizilchAskew@hollandelectronics.com Fri Nov 09 16:43:54 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqbdq-0000P1-9M for ipsec-archive@lists.ietf.org; Fri, 09 Nov 2007 16:43:54 -0500 Received: from 084202220086.customer.alfanett.no ([84.202.220.86] helo=siw) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iqbdp-0006Ob-Tz for ipsec-archive@lists.ietf.org; Fri, 09 Nov 2007 16:43:54 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host79141321.hollandelectronics.com (8.13.1/8.13.1) with SMTP id r7U9GEi029.537485.ts6.pUF.0457909492745 for ; Fri, 9 Nov 2007 22:42:20 -0100 Message-ID: <41b6b01c82319$9e73e890$0401a8c0@siw> From: "Hallie Leary" To: Subject: Your family Date: Fri, 9 Nov 2007 22:42:20 -0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_41B67_01C82319.9E73E890" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_41B67_01C82319.9E73E890 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_41B67_01C82319.9E73E890 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_41B67_01C82319.9E73E890-- From ipsec-bounces@ietf.org Fri Nov 09 17:29:04 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqcLO-0005lc-W3; Fri, 09 Nov 2007 17:28:55 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IqcLM-0005hi-Um for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 17:28:52 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqcLM-0005hW-L7 for ipsec@ietf.org; Fri, 09 Nov 2007 17:28:52 -0500 Received: from mx11.bbn.com ([128.33.0.80]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IqcLJ-0001ox-5T for ipsec@ietf.org; Fri, 09 Nov 2007 17:28:52 -0500 Received: from dhcp89-089-071.bbn.com ([128.89.89.71]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1IqcLI-0001Zb-3f; Fri, 09 Nov 2007 17:28:48 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <1194639081.2477.659.camel@faith.austin.ibm.com> References: <1194632232.2477.636.camel@faith.austin.ibm.com> <20071109183409.GB3152@kebe.East.Sun.COM> <1194639081.2477.659.camel@faith.austin.ibm.com> Date: Fri, 9 Nov 2007 17:28:59 -0500 To: Joy Latten From: Stephen Kent Subject: Re: [IPsec] Use of SPD in verifying incoming packets X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Cc: ipsec@ietf.org, Dan McDonald X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0803426449==" Errors-To: ipsec-bounces@ietf.org --===============0803426449== Content-Type: multipart/alternative; boundary="============_-1017475154==_ma============" --============_-1017475154==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" Joy, The inbound processing diagram (Figue 3) shows how to process traffic in the context of a decorrelated SPD. That is a major improvement that we made in going from 2401 to 4301. For traffic not protected by IPsec, there is an SPD-I cache that either allows traffic to bypass IPsec, or discards the traffic. For traffic that arrives via an SA, the diagram shows an SAD check in the lower right corner. That check replaces the SPD search that was described in 2301. Step 4 of the inbound processing description calls for IPsec traffic to be checked against the SAD entry for the SA via which the traffic was processed. The traffic selectors here should be the ones negotiated for the SA, whether the SPD was de-correlated or not. I fear the text you cited on page 25-26 (not 24-25) is in error. If one looks at the whole paragraph is says: In all cases, when a decorrelated SPD is available, the decorrelated entries are used to populate the SPD-S cache. If the SPD is not decorrelated, caching is not allowed and an ordered search of SPD MUST be performed to verify that inbound traffic arriving on an SA is consistent with the access control policy expressed in the SPD. Note that his text refers to the SPD-S cache, a cache that is used only for outbound traffic, not inbound traffic. So the last sentence is a carryover from the old, 2401 inbound processing description, which we know to be deficient. Sorry 'bout that. Steve --============_-1017475154==_ma============ Content-Type: text/html; charset="us-ascii" Re: [IPsec] Use of SPD in verifying incoming packets
Joy,

The inbound processing diagram (Figue 3) shows how to process traffic in the context of a decorrelated SPD. That is a major improvement that we made in going from 2401 to 4301.  For traffic not protected by IPsec, there is an SPD-I cache that either allows traffic to bypass IPsec, or discards the traffic. For traffic that arrives via an SA, the diagram shows an SAD check in the lower right corner. That check replaces the SPD search that was described in 2301. Step 4 of the inbound processing description calls for IPsec traffic to be checked against the SAD entry for the SA via which the traffic was processed. The traffic selectors here should be the ones negotiated for the SA, whether the SPD was de-correlated or not.

I fear the text you cited on page 25-26 (not 24-25) is in error.  If one looks at the whole paragraph is says:

In all cases, when a decorrelated SPD is available, the decorrelated entries are used to populate the SPD-S cache.  If the SPD is not decorrelated, caching is not allowed and an ordered search of SPD MUST be performed to verify that inbound traffic arriving on an SA is consistent with the access control policy expressed in the SPD.

Note that his text refers to the SPD-S cache, a cache that is used only for outbound traffic, not inbound traffic. So the last sentence is a carryover from the old, 2401 inbound processing description, which we know to be deficient.

Sorry 'bout that.

Steve
--============_-1017475154==_ma============-- --===============0803426449== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============0803426449==-- From ipsec-bounces@ietf.org Fri Nov 09 18:15:01 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqd3v-0007LT-2w; Fri, 09 Nov 2007 18:14:55 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iqd3u-0007LD-3l for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 18:14:54 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqd3t-0007Kq-Pl for ipsec@ietf.org; Fri, 09 Nov 2007 18:14:53 -0500 Received: from e3.ny.us.ibm.com ([32.97.182.143]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iqd3m-0003B6-9y for ipsec@ietf.org; Fri, 09 Nov 2007 18:14:53 -0500 Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236]) by e3.ny.us.ibm.com (8.13.8/8.13.8) with ESMTP id lA9NEh3G016579 for ; Fri, 9 Nov 2007 18:14:43 -0500 Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by d01relay04.pok.ibm.com (8.13.8/8.13.8/NCO v8.6) with ESMTP id lA9NEhcI128094 for ; Fri, 9 Nov 2007 18:14:43 -0500 Received: from d01av01.pok.ibm.com (loopback [127.0.0.1]) by d01av01.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id lA9NEhrY027309 for ; Fri, 9 Nov 2007 18:14:43 -0500 Received: from austin.ibm.com (netmail1.austin.ibm.com [9.41.248.175]) by d01av01.pok.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id lA9NEh8x027299; Fri, 9 Nov 2007 18:14:43 -0500 Received: from faith.austin.ibm.com (faith.austin.ibm.com [9.53.40.35]) by austin.ibm.com (8.13.8/8.12.10) with ESMTP id lA9NEglx046750; Fri, 9 Nov 2007 17:14:42 -0600 Received: from faith.austin.ibm.com (localhost.localdomain [127.0.0.1]) by faith.austin.ibm.com (8.13.4/8.12.8) with ESMTP id lA9N9llu014438; Fri, 9 Nov 2007 17:09:47 -0600 Received: (from jml@localhost) by faith.austin.ibm.com (8.13.4/8.13.4/Submit) id lA9N9kjs014437; Fri, 9 Nov 2007 17:09:46 -0600 X-Authentication-Warning: faith.austin.ibm.com: jml set sender to latten@austin.ibm.com using -f Subject: Re: [IPsec] Use of SPD in verifying incoming packets From: Joy Latten To: Stephen Kent In-Reply-To: References: <1194632232.2477.636.camel@faith.austin.ibm.com> <20071109183409.GB3152@kebe.East.Sun.COM> <1194639081.2477.659.camel@faith.austin.ibm.com> Content-Type: text/plain Content-Transfer-Encoding: 7bit Date: Fri, 09 Nov 2007 17:09:46 -0600 Message-Id: <1194649786.2477.665.camel@faith.austin.ibm.com> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 (2.2.3-2.fc4) X-Spam-Score: -4.0 (----) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Cc: ipsec@ietf.org, Dan McDonald X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org On Fri, 2007-11-09 at 17:28 -0500, Stephen Kent wrote: > Joy, > > > The inbound processing diagram (Figue 3) shows how to process traffic > in the context of a decorrelated SPD. That is a major improvement that > we made in going from 2401 to 4301. For traffic not protected by > IPsec, there is an SPD-I cache that either allows traffic to bypass > IPsec, or discards the traffic. For traffic that arrives via an SA, > the diagram shows an SAD check in the lower right corner. That check > replaces the SPD search that was described in 2301. Step 4 of the > inbound processing description calls for IPsec traffic to be checked > against the SAD entry for the SA via which the traffic was processed. > The traffic selectors here should be the ones negotiated for the SA, > whether the SPD was de-correlated or not. > > I fear the text you cited on page 25-26 (not 24-25) is in error. If > one looks at the whole paragraph is says: > > > In all cases, when a decorrelated SPD is available, the decorrelated > entries are used to populate the SPD-S cache. If the SPD is not > decorrelated, caching is not allowed and an ordered search of SPD MUST > be performed to verify that inbound traffic arriving on an SA is > consistent with the access control policy expressed in the SPD. > > > Note that his text refers to the SPD-S cache, a cache that is used > only for outbound traffic, not inbound traffic. So the last sentence > is a carryover from the old, 2401 inbound processing description, > which we know to be deficient. > > > Sorry 'bout that. > Ok, thanks. That clears it all up for me. Now the named spd entries also make sense to me. :-) regards, Joy _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ErvintrackageNunez@nationallibrary.fi Fri Nov 09 20:54:40 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqfYV-0000kB-K7; Fri, 09 Nov 2007 20:54:39 -0500 Received: from 125-229-65-219.dynamic.hinet.net ([125.229.65.219] helo=j7k1c9) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqfYU-0006LG-UU; Fri, 09 Nov 2007 20:54:39 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host38086926.nationallibrary.fi (8.13.1/8.13.1) with SMTP id lLDOY87b16.682992.Pry.cwS.7501087242018 for ; Sat, 10 Nov 2007 09:54:02 -0800 Message-ID: <29828401c8233c$a06913f0$7d00a8c0@j7k1c9> From: "Al Ballard" To: Subject: Your life Date: Sat, 10 Nov 2007 09:54:02 -0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_298280_01C8233C.A06913F0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_298280_01C8233C.A06913F0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_298280_01C8233C.A06913F0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_298280_01C8233C.A06913F0-- From NewtonminimaxSargent@americanheart.org Sat Nov 10 01:28:24 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqjpP-0008BH-UO; Sat, 10 Nov 2007 01:28:23 -0500 Received: from pool-129-44-208-3.syr.east.verizon.net ([129.44.208.3] helo=family.myhome.westell.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqjpP-0004lX-BX; Sat, 10 Nov 2007 01:28:23 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host54611449.americanheart.org (8.13.1/8.13.1) with SMTP id Sl5UqjRZ75.059327.AtN.6nk.0891030615074 for ; Sat, 10 Nov 2007 01:26:04 +0500 Message-ID: From: "Jed Lindsay" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_EBF0F_01C82362.9C5BD3D0-- From ArrondebauchHolman@suburbanchicagonews.com Sat Nov 10 03:42:12 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqluu-0006Ua-Qh; Sat, 10 Nov 2007 03:42:12 -0500 Received: from 213-156-55-129.fastres.net ([213.156.55.129] helo=119152990319.fastwebnet.it) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iqluu-0008MU-CD; Sat, 10 Nov 2007 03:42:12 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host46493211.suburbanchicagonews.com (8.13.1/8.13.1) with SMTP id tkQMbkST82.656163.7JW.TOE.6987003462357 for ; Sat, 10 Nov 2007 09:41:37 -0100 Message-ID: From: "Antony Gamble" To: Subject: Your order Date: Sat, 10 Nov 2007 09:41:37 -0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_C1808_01C82375.9060ADE0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_C1808_01C82375.9060ADE0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_C1808_01C82375.9060ADE0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_C1808_01C82375.9060ADE0-- From TheresawagnerChildress@economist.com Sat Nov 10 06:01:02 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqo5G-0001IG-1M; Sat, 10 Nov 2007 06:01:02 -0500 Received: from pool-71-162-10-230.pitbpa.fios.verizon.net ([71.162.10.230] helo=emach) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iqo5F-0004Q2-Q5; Sat, 10 Nov 2007 06:01:01 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host45738472.economist.com (8.13.1/8.13.1) with SMTP id H1b1zWE312.979535.qfO.0eV.5512224626663 for ; Sat, 10 Nov 2007 05:58:59 +0500 Message-ID: <49dc401c82388$fb81eea0$6500a8c0@EMACH> From: "Judy Childers" To: Subject: Your life Date: Sat, 10 Nov 2007 05:58:59 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_49DC0_01C82388.FB81EEA0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_49DC0_01C82388.FB81EEA0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_49DC0_01C82388.FB81EEA0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_49DC0_01C82388.FB81EEA0-- From ArchiecanadaReese@fair-online-gambling.com Sat Nov 10 13:03:09 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqufk-0005Dh-TC; Sat, 10 Nov 2007 13:03:08 -0500 Received: from [201.116.164.13] (helo=equipo36) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iqufh-0001Hr-Kr; Sat, 10 Nov 2007 13:03:06 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host55766633.fair-online-gambling.com (8.13.1/8.13.1) with SMTP id ujLaYSid58.608334.YAr.wHV.5521067926856 for ; Sat, 10 Nov 2007 12:02:26 +0600 Message-ID: <1b63c01c823c3$e4e86710$8802a8c0@EQUIPO36> From: "Earnest Higgins" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_1B638_01C823C3.E4E86710-- From tikconstant@wmintl.com Sat Nov 10 16:56:27 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqyJX-00071c-2Z; Sat, 10 Nov 2007 16:56:27 -0500 Received: from [41.248.19.39] (helo=wmintl.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IqyJV-0000bh-Qz; Sat, 10 Nov 2007 16:56:26 -0500 Received: from AMIGO29E25D0D9 ([136.5.37.16]:17411 "HELO AMIGO29E25D0D9" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by 2713f829wmintl.com with ESMTP id 54555567511462 (ORCPT ); Sat, 10 Nov 2007 21:58:13 +0100 Message-ID: <001601c823e4$ca85c860$00b9cc24@AMIGO29E25D0D9> From: mime To: imapext-archive@lists.ietf.org Subject: of deer Date: Sat, 10 Nov 2007 21:58:13 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0013_01C823E4.CA85C860" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.1106 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2462.2962 X-Spam-Score: 0.1 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 This is a multi-part message in MIME format. ------=_NextPart_000_0013_01C823E4.CA85C860 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable How can we see the artists instinctive physical approach to the would be a store salesperson or assistant. One will be able to than they co= uld ever hope to tread upon - never mind absorption. ------=_NextPart_000_0013_01C823E4.CA85C860 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Visual art is what the artist creates, whether it be a be on
<= /P>

Are you wa< >nting a bi< >gger p_ < >e > n _i= s?

A< >s s< >een on T< >V

Over 730,000 Men arou< >nd the world are already sa< >tisfied
Gain 4+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< >= p _t< >o 23%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcises! =
*F _R< >E >< >E B< >m ot< >tles

letter to a sortation plant and sorting of the letter before the
= ------=_NextPart_000_0013_01C823E4.CA85C860-- From RolandodetonatePatrick@williecrawford.com Sat Nov 10 17:45:38 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iqz58-00017X-PH; Sat, 10 Nov 2007 17:45:38 -0500 Received: from pool-71-185-250-8.phlapa.fios.verizon.net ([71.185.250.8] helo=your1sfdbkykfj) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iqz57-0001uF-V7; Sat, 10 Nov 2007 17:45:38 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host31434582.williecrawford.com (8.13.1/8.13.1) with SMTP id jvapf4bw53.342789.G1p.iJP.4173735593262 for ; Sat, 10 Nov 2007 17:46:11 +0500 Message-ID: <201f4601c823eb$a2597ec0$0701a8c0@your1sfdbkykfj> From: "Terrell Bowers" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_201F42_01C823EB.A2597EC0-- From JarviswishboneHull@people.com Sat Nov 10 19:31:30 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ir0ja-0008Ch-2A; Sat, 10 Nov 2007 19:31:30 -0500 Received: from 216-160-160-137.hlrn.qwest.net ([216.160.160.137] helo=lappy.domain.actdsltmp) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ir0jZ-0004Wf-Ne; Sat, 10 Nov 2007 19:31:29 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host35019547.people.com (8.13.1/8.13.1) with SMTP id AZNjBuj851.587727.nAR.BRL.9578674296192 for ; Sat, 10 Nov 2007 17:31:03 +0700 Message-ID: <268fb01c823fa$31e27520$6701a8c0@lappy> From: "Denny Landry" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_268F7_01C823FA.31E27520-- From Hoprasatsukqvgsk@cosmicparrot.com.au Sat Nov 10 20:42:35 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ir1qN-0001SS-Bc for ipsec-archive@lists.ietf.org; Sat, 10 Nov 2007 20:42:35 -0500 Received: from [61.4.214.86] (helo=[61.4.214.86]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ir1qM-0006Hw-6B for ipsec-archive@lists.ietf.org; Sat, 10 Nov 2007 20:42:35 -0500 Received: from winxp ([149.171.198.101] helo=winxp) by [61.4.214.86] ( sendmail 8.13.3/8.13.1) with esmtpa id 1iLQgB-000ZOE-Vy for ipsec-archive@lists.ietf.org; Sun, 11 Nov 2007 10:43:27 +0900 Message-ID: <1A4935DA.5B0677D2@cosmicparrot.com.au> Date: Sun, 11 Nov 2007 10:42:57 +0900 From: "lorence Hoprasatsuk" User-Agent: Thunderbird 1.5.0.10 (Windows/20070221) MIME-Version: 1.0 To: ipsec-archive@lists.ietf.org Subject: ntoplast Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 3.2 (+++) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea http://rossatel.com/ Easy and VERY effective pen*is enlargement nrublil ntoasiat nrobhsil nrypipii From TannercolludeTyson@harpers.org Sat Nov 10 21:32:21 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ir2cX-0006rv-1X; Sat, 10 Nov 2007 21:32:21 -0500 Received: from pool-71-186-192-143.bflony.fios.verizon.net ([71.186.192.143] helo=jackernick.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ir2cW-0007YL-Pg; Sat, 10 Nov 2007 21:32:20 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host56315598.harpers.org (8.13.1/8.13.1) with SMTP id WQfA6V6D43.928577.nGw.s3D.2911230071876 for ; Sat, 10 Nov 2007 20:31:48 +0600 Message-ID: <424ef01c8240b$0eed92f0$0201a8c0@jackernick> From: "Tad Pate" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_424EB_01C8240B.0EED92F0-- From CharlestactThompson@oyez.org Sun Nov 11 06:34:16 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrB4y-0002IP-Gh; Sun, 11 Nov 2007 06:34:16 -0500 Received: from 60-241-0-94.tpgi.com.au ([60.241.0.94] helo=your0548c161e1.belkin) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrB4v-0004JH-Kp; Sun, 11 Nov 2007 06:34:16 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host80707167.oyez.org (8.13.1/8.13.1) with SMTP id zorgO0bi39.389517.BDF.lRM.3053821894958 for ; Sun, 11 Nov 2007 21:33:30 -1000 Message-ID: <5a1f01c82456$c3cc1b60$0202a8c0@your0548c161e1> From: "Steven Robinson" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_5A1B_01C82456.C3CC1B60-- From stas-Londono@stillmountainmovement.com Sun Nov 11 08:25:37 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrCoj-0006Uf-6M for ipsec-archive@lists.ietf.org; Sun, 11 Nov 2007 08:25:37 -0500 Received: from adfg190.neoplus.adsl.tpnet.pl ([79.184.110.190] helo=adfe199.neoplus.adsl.tpnet.pl) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IrCoi-0008Ho-Lg for ipsec-archive@lists.ietf.org; Sun, 11 Nov 2007 08:25:37 -0500 Received: from karpiu ([139.170.54.153] helo=karpiu) by adfe199.neoplus.adsl.tpnet.pl ( sendmail 8.13.3/8.13.1) with esmtpa id 1uldAs-000DSJ-Cz for ipsec-archive@lists.ietf.org; Sun, 11 Nov 2007 14:26:38 +0100 Date: Sun, 11 Nov 2007 14:25:59 +0100 From: "stas Londono" Reply-To: "stas Londono" Message-ID: <027051842507.755696390051@stillmountainmovement.com> To: Subject: ore-smel MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="windows-1250"; reply-type=original X-Spam-Score: 3.9 (+++) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea http://www.tennmix.com/ This stuff is selling like crazy, As seen on TV org orolfinu orptrats or-hguor From InajessicaButcher@nascar.com Sun Nov 11 15:34:04 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrJVM-0001F0-4Y; Sun, 11 Nov 2007 15:34:04 -0500 Received: from [190.48.163.199] (helo=alfredo) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrJVL-0000YB-DB; Sun, 11 Nov 2007 15:34:04 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host67111939.nascar.com (8.13.1/8.13.1) with SMTP id l7bvo2HH73.020688.aiF.0AG.8621131422953 for ; Sun, 11 Nov 2007 17:34:12 +0300 Message-ID: <4613301c824a2$41588000$fc01a8c0@ALFREDO> From: "Lourdes Stiles" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_4612F_01C824A2.41588000-- From HelenefobBurgos@tattiebogle.net Sun Nov 11 19:22:52 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrN4m-0007XT-Pi; Sun, 11 Nov 2007 19:22:52 -0500 Received: from 217.216.176.70.dyn.user.ono.com ([217.216.176.70] helo=ernesto9482ebb) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrN4m-00083y-3r; Sun, 11 Nov 2007 19:22:52 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host85783565.tattiebogle.net (8.13.1/8.13.1) with SMTP id kGPz5SxG88.112447.E5J.zey.6312406221493 for ; Mon, 12 Nov 2007 01:22:06 -0100 Message-ID: <7341d01c824c2$19d87290$46b0d8d9@ernesto9482ebb> From: "Francisca Akins" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_73419_01C824C2.19D87290-- From JessebringHughes@photomatt.net Sun Nov 11 20:01:09 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrNfo-0001li-QM; Sun, 11 Nov 2007 20:01:08 -0500 Received: from [201.237.172.34] (helo=pc2) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrNfo-0001Jb-Cv; Sun, 11 Nov 2007 20:01:08 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host66529758.photomatt.net (8.13.1/8.13.1) with SMTP id WML2SdDt95.921575.PFd.0jj.6550913924308 for ; Sun, 11 Nov 2007 19:00:53 -0100 Message-ID: <1b50801c8248c$d79bea40$0301a8c0@PC2> From: "Ernest Butler" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_1B504_01C8248C.D79BEA40-- From PenelopetowheadWashburn@europa.eu Sun Nov 11 21:14:48 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrOp4-0000lH-Ve; Sun, 11 Nov 2007 21:14:48 -0500 Received: from [190.24.239.188] (helo=cafe2) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrOp4-0003Sv-GJ; Sun, 11 Nov 2007 21:14:46 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host39803504.europa.eu (8.13.1/8.13.1) with SMTP id PGm0bqX369.084169.Uk2.xOl.1247635007437 for ; Sun, 11 Nov 2007 21:14:18 +0500 Message-ID: <3062e01c824d1$c90c7220$0400a8c0@cafe2> From: "Tabatha Abel" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_3062A_01C824D1.C90C7220-- From AntonimponderableKemp@suburbanchicagonews.com Mon Nov 12 03:58:22 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrV7e-0002Lx-7h; Mon, 12 Nov 2007 03:58:22 -0500 Received: from c-71-59-79-7.hsd1.pa.comcast.net ([71.59.79.7] helo=cody.chn.comcast.net) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrV7e-0003Te-04; Mon, 12 Nov 2007 03:58:22 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host35524804.suburbanchicagonews.com (8.13.1/8.13.1) with SMTP id eeoDnYVL24.025957.sk9.MJv.6227758489199 for ; Mon, 12 Nov 2007 03:57:35 +0500 Message-ID: <806a201c8250a$1d7a8ad0$0c00a8c0@Cody> From: "Buddy Savage" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_8069E_01C8250A.1D7A8AD0-- From EvangelineyostParson@boingboing.net Mon Nov 12 10:48:16 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrbWK-0004xs-GP; Mon, 12 Nov 2007 10:48:16 -0500 Received: from 85-18-14-9.fastres.net ([85.18.14.9] helo=blesme.fastwebnet.it) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrbWJ-0004L7-Er; Mon, 12 Nov 2007 10:48:16 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host03472212.boingboing.net (8.13.1/8.13.1) with SMTP id GcG3PejU66.959760.5in.sYP.3385516347158 for ; Mon, 12 Nov 2007 16:47:55 -0100 Message-ID: <238401c82543$6f7feb70$7504f12a@blesme> From: "Nadia Light" To: Subject: Confirmation link Date: Mon, 12 Nov 2007 16:47:55 -0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_2380_01C82543.6F7FEB70" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Antivirus: avast! (VPS 071111-1, 11/11/2007), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_2380_01C82543.6F7FEB70 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_2380_01C82543.6F7FEB70 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_2380_01C82543.6F7FEB70-- From GretaresidentialPurvis@washingtonpost.com Mon Nov 12 13:33:04 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ire5o-00029a-8b; Mon, 12 Nov 2007 13:33:04 -0500 Received: from [212.46.46.23] (helo=home7ebc292fb6.lan) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ire5g-0004UZ-Nh; Mon, 12 Nov 2007 13:33:04 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host15910378.washingtonpost.com (8.13.1/8.13.1) with SMTP id e8Lt3ZGE93.318414.0aM.D6b.4729525379697 for ; Tue, 13 Nov 2007 09:32:05 -0200 Message-ID: <153701c825c7$6091d9f0$4101a8c0@home7ebc292fb6> From: "Rhoda Steiner" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_1533_01C825C7.6091D9F0-- From KaseyflameCullen@tattiebogle.net Mon Nov 12 14:34:28 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Irf3E-0004CE-9V; Mon, 12 Nov 2007 14:34:28 -0500 Received: from host81-152-115-145.range81-152.btcentralplus.com ([81.152.115.145] helo=marie93d8edb88.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Irf3D-0006zu-QE; Mon, 12 Nov 2007 14:34:28 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host61319310.tattiebogle.net (8.13.1/8.13.1) with SMTP id CaK4XOmU10.626944.cAG.FOl.6706881814587 for ; Mon, 12 Nov 2007 19:33:55 +0000 Message-ID: <721fc01c82563$04675510$4001a8c0@marie93d8edb88> From: "Ophelia Starnes" To: Subject: Confirmation link Date: Mon, 12 Nov 2007 19:33:55 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_721F8_01C82563.04675510" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_721F8_01C82563.04675510 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_721F8_01C82563.04675510 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_721F8_01C82563.04675510-- From ForrestattendeeFitzgerald@makeupminute.com Mon Nov 12 15:19:24 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Irfkh-0003Xx-Ih; Mon, 12 Nov 2007 15:19:23 -0500 Received: from c-69-250-229-56.hsd1.md.comcast.net ([69.250.229.56] helo=karson.hsd1.md.comcast.net) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Irfkh-0000XV-9D; Mon, 12 Nov 2007 15:19:23 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host50207402.makeupminute.com (8.13.1/8.13.1) with SMTP id M3NkvqBd12.226926.v3f.Anb.3240411859216 for ; Mon, 12 Nov 2007 15:19:08 +0500 Message-ID: <129fed01c82569$51044fd0$6501a8c0@Karson> From: "Jake Sandoval" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_129FE9_01C82569.51044FD0-- From MontybreatheMcdowell@graffiti.org Mon Nov 12 17:18:58 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrhcQ-0001oG-A2; Mon, 12 Nov 2007 17:18:58 -0500 Received: from [190.40.113.126] (helo=toshiba.lan) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrhcP-0006CS-PL; Mon, 12 Nov 2007 17:18:58 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host39990498.graffiti.org (8.13.1/8.13.1) with SMTP id JsItHGXQ09.499891.e3z.skb.5183191321508 for ; Mon, 12 Nov 2007 17:18:18 +0500 Message-ID: From: "Mason Orr" To: Subject: Your life Date: Mon, 12 Nov 2007 17:18:18 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_E92B_01C82579.F66788B0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_E92B_01C82579.F66788B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_E92B_01C82579.F66788B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_E92B_01C82579.F66788B0-- From Troy621@gottenandmarron.zzn.com Mon Nov 12 17:37:23 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrhuF-0007UV-1B for ipsec-archive@lists.ietf.org; Mon, 12 Nov 2007 17:37:23 -0500 Received: from [189.25.168.74] (helo=[189.25.168.74]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IrhuE-0006ts-7v for ipsec-archive@lists.ietf.org; Mon, 12 Nov 2007 17:37:22 -0500 Received: from BLACK ([180.121.37.75] helo=BLACK) by [189.25.168.74] ( sendmail 8.13.3/8.13.1) with esmtpa id 1NXsdd-000DWW-Pz for ipsec-archive@lists.ietf.org; Mon, 12 Nov 2007 20:37:39 -0200 Message-ID: <000601c8257c$98328800$4aa819bd@BLACK> From: "Troy friedline" To: ipsec-archive@lists.ietf.org Subject: inoxylol Date: Mon, 12 Nov 2007 20:37:23 -0200 Message-ID: <000601c8257c$98328800$4aa819bd@BLACK> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.6626 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 4.6 (++++) X-Scan-Signature: 6d62ab47271805379d7172ee693a45db pole drive that pussy with confidence, add some length Luel meeuse http://www.unweacad.com/ From KrystalpictorialHolliday@williebird.com Tue Nov 13 03:30:41 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrrAO-00067U-W5; Tue, 13 Nov 2007 03:30:41 -0500 Received: from 125-24-135-40.adsl.totbb.net ([125.24.135.40] helo=finance3) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IrrAL-0000QE-PI; Tue, 13 Nov 2007 03:30:40 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host24929704.williebird.com (8.13.1/8.13.1) with SMTP id k7w1IZ2B40.245659.K0p.iPp.1129730131105 for ; Tue, 13 Nov 2007 15:28:57 -0700 Message-ID: <3b66901c825cf$4a4bd1c0$1d0aa8c0@finance3> From: "Nadine Kern" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_3B665_01C825CF.4A4BD1C0-- From hedeoneduardo62@catalogs4u.com Tue Nov 13 08:15:32 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Irvc4-00029c-Og for ipsec-archive@lists.ietf.org; Tue, 13 Nov 2007 08:15:32 -0500 Received: from [211.208.31.242] (helo=211.208.31.242) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Irvc3-0002nU-OE for ipsec-archive@lists.ietf.org; Tue, 13 Nov 2007 08:15:32 -0500 Received: from [211.208.31.242] by ulqongm.catalogs4u.com; Tue, 13 Nov 2007 18:15:36 +0000 Message-ID: <000a01c82621$039c278c$6d6b858f@ygysab> From: "huberto margalit" To: "Deanna Carney" Subject: Our large selection of products Date: Tue, 13 Nov 2007 16:28:13 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C82621.03964C8C" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C82621.03964C8C Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Replica Rolex Watches and More…Great Products, Great Prices!=20 http://popullatrave.net/ ------=_NextPart_000_0007_01C82621.03964C8C Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Replica Rolex Watches and More…Great Products, Great Prices! =

http://popullatrave.net/ ------=_NextPart_000_0007_01C82621.03964C8C-- From desplanquesioity@webct31.prenhall.com Tue Nov 13 10:34:11 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrxmF-0008Jz-Af for ipsec-archive@lists.ietf.org; Tue, 13 Nov 2007 10:34:11 -0500 Received: from [24.121.203.43] (helo=[24.121.203.43]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IrxmE-0001O1-Ut for ipsec-archive@lists.ietf.org; Tue, 13 Nov 2007 10:34:11 -0500 Received: from brian-nfvnjcdij ([141.137.28.16] helo=brian-nfvnjcdij) by [24.121.203.43] ( sendmail 8.13.3/8.13.1) with esmtpa id 1bzBoc-000LWG-gE for ipsec-archive@lists.ietf.org; Tue, 13 Nov 2007 09:33:57 -0600 Message-ID: <000801c8260a$91a95020$2bcb7918@briannfvnjcdij> From: "rane desplanques" To: Subject: elepko Date: Tue, 13 Nov 2007 09:33:41 -0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C825D8.470EE020" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 0.1 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 ------=_NextPart_000_0007_01C825D8.470EE020 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Before Manster i never scored any ladies, now i=92ve had 5 this week, = its all about confidence funglim ciaccio http://wwwveiw.com/ ------=_NextPart_000_0007_01C825D8.470EE020 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Before Manster i never scored any ladies, now = i=92ve had 5=20 this week, its all about confidence
funglim ciaccio
http://wwwveiw.com/
<= /HTML> ------=_NextPart_000_0007_01C825D8.470EE020-- From AndersonhamburgBattle@supremecommander.com Tue Nov 13 11:24:24 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IryYp-0001Or-Qo; Tue, 13 Nov 2007 11:24:23 -0500 Received: from pool-71-245-77-141.prvdri.fios.verizon.net ([71.245.77.141] helo=iasimone.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IryYp-0004bu-8w; Tue, 13 Nov 2007 11:24:23 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host87746494.supremecommander.com (8.13.1/8.13.1) with SMTP id F6tYq0Vq98.145434.4og.9T4.4186079998271 for ; Tue, 13 Nov 2007 11:22:47 +0500 Message-ID: <3398b201c82611$78bad9b0$0201a8c0@IASIMONE> From: "Morton Howe" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_3398AE_01C82611.78BAD9B0-- From ipsec-bounces@ietf.org Tue Nov 13 11:37:42 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iryl0-00052j-RN; Tue, 13 Nov 2007 11:36:58 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Irykz-00052H-HC for ipsec-confirm+ok@megatron.ietf.org; Tue, 13 Nov 2007 11:36:57 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iryky-000523-ND for ipsec@ietf.org; Tue, 13 Nov 2007 11:36:56 -0500 Received: from e6.ny.us.ibm.com ([32.97.182.146]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iryks-0002zS-Vk for ipsec@ietf.org; Tue, 13 Nov 2007 11:36:56 -0500 Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236]) by e6.ny.us.ibm.com (8.13.8/8.13.8) with ESMTP id lADGcSKN019300 for ; Tue, 13 Nov 2007 11:38:28 -0500 Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by d01relay04.pok.ibm.com (8.13.8/8.13.8/NCO v8.6) with ESMTP id lADGaoar127818 for ; Tue, 13 Nov 2007 11:36:50 -0500 Received: from d01av01.pok.ibm.com (loopback [127.0.0.1]) by d01av01.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id lADGao0x025743 for ; Tue, 13 Nov 2007 11:36:50 -0500 Received: from austin.ibm.com (netmail2.austin.ibm.com [9.41.248.176]) by d01av01.pok.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id lADGanBi025702; Tue, 13 Nov 2007 11:36:49 -0500 Received: from faith.austin.ibm.com (faith.austin.ibm.com [9.53.40.35]) by austin.ibm.com (8.13.8/8.12.10) with ESMTP id lADGanmq048030; Tue, 13 Nov 2007 10:36:49 -0600 Received: from faith.austin.ibm.com (localhost.localdomain [127.0.0.1]) by faith.austin.ibm.com (8.13.4/8.12.8) with ESMTP id lADGVlu5020123; Tue, 13 Nov 2007 10:31:47 -0600 Received: (from jml@localhost) by faith.austin.ibm.com (8.13.4/8.13.4/Submit) id lADGVhrf020122; Tue, 13 Nov 2007 10:31:43 -0600 X-Authentication-Warning: faith.austin.ibm.com: jml set sender to latten@austin.ibm.com using -f From: Joy Latten To: ipsec@ietf.org Content-Type: text/plain Content-Transfer-Encoding: 7bit Date: Tue, 13 Nov 2007 10:31:43 -0600 Message-Id: <1194971503.2477.685.camel@faith.austin.ibm.com> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 (2.2.3-2.fc4) X-Spam-Score: -4.0 (----) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Cc: tchicks@us.ibm.com, tgraf@redhat.com, herbert@gondor.apana.org.au Subject: [IPsec] ESP's use of dummy packets? X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org RFC 4303 introduces the use of dummy packets within ESP. Section 2.6 states, A transmitter MUST be capable of generating dummy packets marked with this value in the next protocol field, and a receiver MUST be prepared to discard such packets, without indicating an error. However, it is not clear to me whether an IPsec/ESP implementation MUST use this feature. That is, it MUST send out dummy packets at random intervals or in a way to shape the traffic. I interpreted the above statement to mean that an implementation must only have the capability. Further clarification if I have misinterpreted would be greatly appreciated. regards, Joy _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 13 12:19:03 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrzP7-0002WN-O0; Tue, 13 Nov 2007 12:18:25 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IrzP3-0002QH-LB for ipsec-confirm+ok@megatron.ietf.org; Tue, 13 Nov 2007 12:18:21 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IrzP1-0002OU-TE for ipsec@ietf.org; Tue, 13 Nov 2007 12:18:20 -0500 Received: from mx12.bbn.com ([128.33.0.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IrzOu-00050E-78 for ipsec@ietf.org; Tue, 13 Nov 2007 12:18:19 -0500 Received: from col-dhcp33-244-186.bbn.com ([128.33.244.186]) by mx12.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1IrzOt-0004ET-3J; Tue, 13 Nov 2007 12:18:11 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <1194971503.2477.685.camel@faith.austin.ibm.com> References: <1194971503.2477.685.camel@faith.austin.ibm.com> Date: Tue, 13 Nov 2007 12:15:24 -0500 To: Joy Latten From: Stephen Kent Subject: Re: [IPsec] ESP's use of dummy packets? Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Cc: ipsec@ietf.org, tchicks@us.ibm.com, tgraf@redhat.com, herbert@gondor.apana.org.au X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org At 10:31 AM -0600 11/13/07, Joy Latten wrote: >RFC 4303 introduces the use of dummy packets within ESP. >Section 2.6 states, > A transmitter MUST be capable of generating dummy packets marked > with this value in the next protocol field, and a receiver MUST > be prepared to discard such packets, without indicating an error. > >However, it is not clear to me whether an IPsec/ESP implementation MUST >use this feature. That is, it MUST send out dummy packets at random >intervals or in a way to shape the traffic. I interpreted the above >statement to mean that an implementation must only have the capability. > >Further clarification if I have misinterpreted would be greatly appreciated. > >regards, >Joy Like most IETF standards, IPsec specifies capabilities of conformant implementations. It does not mandate that a user enable all of the features that MUST be present in an implementation. So, no, an implementation should not be sending dummy packets unless the user (or sys admin) instructs it to do so via appropriate config controls. Steve _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From LupecredentBurt@closersounds.com Tue Nov 13 16:27:28 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Is3I8-0004NZ-Tb; Tue, 13 Nov 2007 16:27:28 -0500 Received: from [200.123.139.13] (helo=ruben) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Is3I8-0000Td-4k; Tue, 13 Nov 2007 16:27:28 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host33303208.closersounds.com (8.13.1/8.13.1) with SMTP id ZXcF20g054.069480.d2s.edb.8548988461345 for ; Tue, 13 Nov 2007 18:27:09 +0300 Message-ID: <2bd2c01c8263c$00aead40$1609010a@Ruben> From: "Dee Sargent" To: Subject: Your order Date: Tue, 13 Nov 2007 18:27:09 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_2BD28_01C8263C.00AEAD40" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_2BD28_01C8263C.00AEAD40 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_2BD28_01C8263C.00AEAD40 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_2BD28_01C8263C.00AEAD40-- From MurielseriateRuffin@5thirtyone.com Tue Nov 13 20:06:58 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Is6iY-0000hv-OK; Tue, 13 Nov 2007 20:06:58 -0500 Received: from [89.211.185.159] (helo=demozi53a55697.lan) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Is6iW-0005t1-Um; Tue, 13 Nov 2007 20:06:58 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host87779959.5thirtyone.com (8.13.1/8.13.1) with SMTP id UOIlFsWb91.480482.Azr.5uJ.2887959040397 for ; Wed, 14 Nov 2007 04:06:06 -0300 Message-ID: <1d64801c8265a$98fe3d90$4001a8c0@demozi53a55697> From: "Marcella Starks" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_1D644_01C8265A.98FE3D90-- From ipsec-bounces@ietf.org Wed Nov 14 00:34:57 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsAt9-0000XH-7s; Wed, 14 Nov 2007 00:34:11 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IsAt8-0000XC-8I for ipsec-confirm+ok@megatron.ietf.org; Wed, 14 Nov 2007 00:34:10 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsAt7-0000Vi-Sv for ipsec@lists.ietf.org; Wed, 14 Nov 2007 00:34:09 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IsAt3-0005nx-6W for ipsec@lists.ietf.org; Wed, 14 Nov 2007 00:34:09 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1IsAsw-0005UE-IS for ipsec@lists.ietf.org; Wed, 14 Nov 2007 05:33:58 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 14 Nov 2007 05:33:58 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 14 Nov 2007 05:33:58 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Wed, 14 Nov 2007 00:33:44 -0500 Lines: 166 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070510 Iceape/1.0.9 (Debian-1.0.9-0etch1) X-Spam-Score: -0.0 (/) X-Scan-Signature: 21be852dc93f0971708678c18d38c096 Cc: Subject: [IPsec] test vectors for IKEv2 SKEYSEED derivation X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org I'm looking for some test vectors for SKEYSEED calculation. I asked google a bit, but I didn't find anything published on the IPsec list. Perhaps there are some materials from one of the bakeoffs. I wish that we had put some vectors into rfc4306. I saw that there are some vectors in the SHA256 drafts, but I don't think that they give enough detail to confirm that an implementation has done the right thing. Obviously, I'm going to try interoperating, but it isn't always easy to find the error in the calculation when looking a black box. If someone would be willing the confirm my calculations, my inputs and output are listed below, or in C-hex files at: http://git.openswan.org/cgi-bin/gitweb.cgi?p=openswan.git;a=blob;f=testing/lib/libpluto/seam_gi.c;h=cfaa33012e3e3506e7cf62f5a64a7ca6b51d7a98;hb=7a2a3bf55fc19df377e78ea61673d74656ece8b0 http://git.openswan.org/cgi-bin/gitweb.cgi?p=openswan.git;a=blob;f=testing/lib/libpluto/seam_gi_sha1.c;h=e980dabd5cc17b3f12b56085ac7f09eccf60f861;hb=9d417f4bb2ebb4333dda6e228e7bc0eae834f61a For instance, this is my calculation with MD5 as the PRF, HMAC-MD5 as the intended auth and 3DES as the intended cipher for the PARENT_SA. (I.e. 128 bits required for SK_a and SK_p, and 192 bits for SK_e). (THESE ARE NOT CONFIRMED!!!) | spii 75 46 d3 d6 ea 09 f7 df | spir 61 a6 78 6a 41 ea 48 06 | ni b5 ce 84 19 09 5c 6e 2b 6b 62 d3 05 53 05 b3 c4 | nr 47 e9 f9 25 8c a2 38 58 f6 75 b1 66 b0 2c c2 92 | gi ff bc 6a 92 a6 b9 55 9b 05 fa 96 a7 a4 35 07 b4 | c1 e1 c0 86 1a 58 71 d9 ba 73 a1 63 11 37 88 c0 | de bb 39 79 e7 ff 0c 52 b4 ce 60 50 eb 05 36 9e | a4 30 0d 2b ff 3b 1b 29 9f 3b 80 2c cb 13 31 8c | 2a b9 e3 b5 62 7c b4 b3 5e b9 39 98 20 76 b5 7c | 05 0d 7b 35 c3 c5 c7 cc 8c 0f ea b7 b6 4a 7d 7b | 6b 8f 6b 4d ab f4 ac 40 6d d2 01 26 b9 0a 98 ac | 76 6e fa 37 a7 89 0c 43 94 ff 9a 77 61 5b 58 f5 | 2d 65 1b bf a5 8d 2a 54 9a f8 b0 1a a4 bc a3 d7 | 62 42 66 63 b1 55 d4 eb da 9f 60 a6 a1 35 73 e6 | a8 88 13 5c dc 67 3d d4 83 02 99 03 f3 a9 0e ca | 23 e1 ec 1e 27 03 31 b2 d0 50 f4 f7 58 f4 99 27 | gr cd 30 df 6e c0 85 44 12 53 01 80 d8 7e 1a fb b3 | 26 79 3e 99 56 c8 6a 96 25 53 c2 77 ad 5b ab 50 | f8 32 5a d8 64 0b 0e fe a5 1d 6c 83 1f a1 7c fb | 0f 2e 1a f4 b1 66 a0 fe 30 75 12 ad 0f 81 ab b8 | aa fb 68 48 ec 10 a4 97 6c 3d b1 17 ec e1 e6 61 | db bf 48 0c 28 2e 3f 11 07 c1 86 42 80 1e e8 3f | 9e 4a b9 ab 63 6f 23 7d aa f6 a7 aa d8 22 99 3e | a4 1e a3 31 ee 27 82 0b 93 f5 0b 8f 3f 71 05 61 | c9 25 70 26 97 ba 6b 1e 95 3c 21 fb c9 a7 7d 2b | 5f 87 3c fc 50 99 e7 7d 48 4c dd 52 66 4b cf 0d | bf 00 ca fd ae 6d e7 14 6d 11 35 f6 5d 93 5f 60 | b9 73 0f e0 49 2c 2a f8 c9 04 f6 4c 59 16 90 9d | secret 17 9b b3 22 a6 77 6f bc 01 4e 41 03 f0 f6 2e 93 | fb 07 d0 93 84 57 e4 54 1e 64 46 a9 34 37 c0 9d | DH calculation gives: | c2 e9 1d a2 05 63 19 6e 34 89 df d1 af a5 4a 51 | 09 4d 76 2e ff bf 39 a6 1a 64 f4 8c 8e fb 0a 4f | ac 5a a3 18 01 aa 1a cc 94 d6 91 50 96 38 16 8b | dd 39 19 c3 5e 99 5a 92 3d e3 fa 2c 2d 21 cb 15 | ac 7a 81 49 ab 37 33 f7 55 a3 25 a0 90 4a 87 bb | fe 70 71 8b 63 ba af 56 a7 b4 8f 54 d5 0d 17 95 | 14 f3 09 21 da d6 8c 71 8c d4 82 89 06 c4 24 75 | 4b 55 4c d9 91 83 ce b6 ad ae 6a 5e 7d bf f9 ef | ae 60 a7 b7 97 b6 31 50 4e cc 0f ff 17 f1 aa 4b | 1e 0c 61 71 32 d6 b9 79 58 61 e6 ab f3 67 d8 9e | 3c db 68 3e ff 9e 37 ea 67 70 21 0e 07 ea b6 2b | 72 30 ea 5d 55 86 9a 04 86 ed e1 c7 bd ee 61 84 | skeyseed: 35 8e b1 84 d9 02 7e a2 a3 b3 e6 08 b9 2f 5f bf | prf+[1]: 52 9a 10 2f 28 df 41 78 6e c2 75 e1 06 3b d2 50 | prf+[2]: 3e 43 b9 a8 f8 4e b0 2b a1 be 33 6f 4a 37 da 21 | prf+[3]: ba 4e fe 1c f0 0a 4d b0 22 02 5d 4f 53 b9 56 45 | prf+[4]: 50 a9 46 72 7a af fb 5d 8f 85 21 d4 88 eb 84 ec | prf+[5]: 72 87 28 fe b0 6a 22 c2 83 c5 c2 82 bb f7 d5 b7 | prf+[6]: 7a dc 9f 0b 1d 32 11 cc 90 22 79 2c 20 b4 93 d6 | prf+[7]: 18 01 15 e0 86 ce d3 95 6b 1a b1 f7 7b bb 6f 2d | prf+[8]: c0 47 bc 10 1f d5 b0 e9 b2 9f 74 93 2a 8e c4 3a | SK_d: 52 9a 10 2f 28 df 41 78 6e c2 75 e1 06 3b d2 50 | SK_ai: 3e 43 b9 a8 f8 4e b0 2b a1 be 33 6f 4a 37 da 21 | SK_ar: ba 4e fe 1c f0 0a 4d b0 22 02 5d 4f 53 b9 56 45 | SK_ei: 50 a9 46 72 7a af fb 5d 8f 85 21 d4 88 eb 84 ec | 72 87 28 fe b0 6a 22 c2 | SK_er: 83 c5 c2 82 bb f7 d5 b7 7a dc 9f 0b 1d 32 11 cc | 90 22 79 2c 20 b4 93 d6 | SK_pi: 18 01 15 e0 86 ce d3 95 6b 1a b1 f7 7b bb 6f 2d | SK_pr: c0 47 bc 10 1f d5 b0 e9 b2 9f 74 93 2a 8e c4 3a And for AES128 and SHA1: | spii 75 46 d3 d6 ea 09 f7 df | spir 61 a6 78 6a 41 ea 48 06 | ni b5 ce 84 19 09 5c 6e 2b 6b 62 d3 05 53 05 b3 c4 | nr 47 e9 f9 25 8c a2 38 58 f6 75 b1 66 b0 2c c2 92 | gi ff bc 6a 92 a6 b9 55 9b 05 fa 96 a7 a4 35 07 b4 | c1 e1 c0 86 1a 58 71 d9 ba 73 a1 63 11 37 88 c0 | de bb 39 79 e7 ff 0c 52 b4 ce 60 50 eb 05 36 9e | a4 30 0d 2b ff 3b 1b 29 9f 3b 80 2c cb 13 31 8c | 2a b9 e3 b5 62 7c b4 b3 5e b9 39 98 20 76 b5 7c | 05 0d 7b 35 c3 c5 c7 cc 8c 0f ea b7 b6 4a 7d 7b | 6b 8f 6b 4d ab f4 ac 40 6d d2 01 26 b9 0a 98 ac | 76 6e fa 37 a7 89 0c 43 94 ff 9a 77 61 5b 58 f5 | 2d 65 1b bf a5 8d 2a 54 9a f8 b0 1a a4 bc a3 d7 | 62 42 66 63 b1 55 d4 eb da 9f 60 a6 a1 35 73 e6 | a8 88 13 5c dc 67 3d d4 83 02 99 03 f3 a9 0e ca | 23 e1 ec 1e 27 03 31 b2 d0 50 f4 f7 58 f4 99 27 | gr cd 30 df 6e c0 85 44 12 53 01 80 d8 7e 1a fb b3 | 26 79 3e 99 56 c8 6a 96 25 53 c2 77 ad 5b ab 50 | f8 32 5a d8 64 0b 0e fe a5 1d 6c 83 1f a1 7c fb | 0f 2e 1a f4 b1 66 a0 fe 30 75 12 ad 0f 81 ab b8 | aa fb 68 48 ec 10 a4 97 6c 3d b1 17 ec e1 e6 61 | db bf 48 0c 28 2e 3f 11 07 c1 86 42 80 1e e8 3f | 9e 4a b9 ab 63 6f 23 7d aa f6 a7 aa d8 22 99 3e | a4 1e a3 31 ee 27 82 0b 93 f5 0b 8f 3f 71 05 61 | c9 25 70 26 97 ba 6b 1e 95 3c 21 fb c9 a7 7d 2b | 5f 87 3c fc 50 99 e7 7d 48 4c dd 52 66 4b cf 0d | bf 00 ca fd ae 6d e7 14 6d 11 35 f6 5d 93 5f 60 | b9 73 0f e0 49 2c 2a f8 c9 04 f6 4c 59 16 90 9d | secret 17 9b b3 22 a6 ab cd ef 01 4e 41 03 f2 f6 2e 93 | fb 07 d4 93 84 57 e4 54 1e 64 46 a9 34 37 c4 9d | DH calculation gives: | 60 76 62 71 0c 76 fe 27 4f 6f 7c 9f 68 cf cf e0 | a7 56 44 cb a1 92 2a b9 c9 c2 16 0e a7 80 d0 71 | 50 06 87 10 85 f0 80 30 58 c4 2e c9 d6 ae 4f 53 | 41 b6 2b 7c 66 8d 9f ba 20 15 5a 7c 23 60 e6 22 | 03 55 a0 80 3b c9 11 a5 6f c7 30 0d d7 f6 6b 01 | c4 88 ab 8f 79 1a d2 cc 58 8d 28 c0 c0 78 fa 61 | 21 d5 88 1b 3a e9 b4 a7 d8 c9 a6 58 60 6e 0a 2a | 5e 9c 5f 9e c2 b5 0b 63 d7 af bb 80 f4 a4 83 37 | ce de f5 aa 6f a1 a0 f3 af c3 21 47 19 2c 7f ba | 7e 27 9f 00 28 81 21 cb 3d e7 f1 d9 76 fd f1 6c | 99 28 db 95 92 38 f7 83 a4 fd 38 75 7e 55 2c e9 | 2d db d6 f5 0c 1d 35 af 77 34 fc 85 cb 30 b8 09 | skeyseed: 9d 8e 53 96 0b 36 01 f4 c0 d3 29 ee 1e c3 70 27 | 0d 06 22 17 | prf+[1]: ac 97 eb 39 07 53 a4 5d 61 c1 64 ff ca 25 99 b0 | 2e 05 3c 7e | prf+[2]: 4e a8 e6 62 b0 7c dd 43 0f 69 44 c6 72 3e 4b 82 | d5 72 24 18 | prf+[3]: 51 5b 0b d2 2e 6d 76 b3 4f db 76 0a a7 bf ad 80 | b1 09 b7 5d | prf+[4]: 3f 44 bf 47 ca fd 81 50 59 1d eb 08 81 99 fc bf | be db 67 ec | prf+[5]: 7d c3 d0 0c cc ac 42 e7 0c d6 3b de cc 07 97 44 | b4 a3 4e 8a | prf+[6]: 0d 2f 27 8b ee 06 6d 07 a5 a5 75 2e e9 00 11 7e | 41 d4 31 62 | prf+[7]: 40 b8 63 22 bf 06 9f bc eb 81 58 e7 6a 49 14 75 | 56 d3 3c 8e | SK_d: ac 97 eb 39 07 53 a4 5d 61 c1 64 ff ca 25 99 b0 | 2e 05 3c 7e | SK_ai: 4e a8 e6 62 b0 7c dd 43 0f 69 44 c6 72 3e 4b 82 | d5 72 24 18 | SK_ar: 51 5b 0b d2 2e 6d 76 b3 4f db 76 0a a7 bf ad 80 | b1 09 b7 5d | SK_ei: 3f 44 bf 47 ca fd 81 50 59 1d eb 08 81 99 fc bf | SK_er: be db 67 ec 7d c3 d0 0c cc ac 42 e7 0c d6 3b de | SK_pi: cc 07 97 44 b4 a3 4e 8a 0d 2f 27 8b ee 06 6d 07 | a5 a5 75 2e | SK_pr: e9 00 11 7e 41 d4 31 62 40 b8 63 22 bf 06 9f bc | eb 81 58 e7 _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ChristinaoctalBrandt@closer.com Wed Nov 14 09:57:01 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsJfo-000504-Sa; Wed, 14 Nov 2007 09:57:00 -0500 Received: from pool-70-109-158-64.cncdnh.east.verizon.net ([70.109.158.64] helo=dgvqdv81) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsJfn-0002Py-Uh; Wed, 14 Nov 2007 09:57:00 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host85132729.closer.com (8.13.1/8.13.1) with SMTP id HdqXI0ml71.649936.Bb8.o8F.3167764111384 for ; Wed, 14 Nov 2007 09:53:45 +0500 Message-ID: <2c42c01c826ce$32e78010$6402a8c0@DGVQDV81> From: "Christina Polk" To: Subject: Your family Date: Wed, 14 Nov 2007 09:53:45 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_2C428_01C826CE.32E78010" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_2C428_01C826CE.32E78010 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_2C428_01C826CE.32E78010 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_2C428_01C826CE.32E78010-- From neeomrh@tufa.de Wed Nov 14 10:41:42 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsKN4-0001Hb-KE for ipsec-archive@lists.ietf.org; Wed, 14 Nov 2007 10:41:42 -0500 Received: from host128-43-dynamic.59-82-r.retail.telecomitalia.it ([82.59.43.128]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IsKN4-00087V-5T for ipsec-archive@lists.ietf.org; Wed, 14 Nov 2007 10:41:42 -0500 Received: from utente-5b43c700 ([178.138.86.76]:5137 "EHLO utente-5b43c700" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by host128-43-dynamic.59-82-r.retail.telecomitalia.it with ESMTP id S22GEVNIVDXZVFYY (ORCPT ); Wed, 14 Nov 2007 16:42:19 +0100 Message-ID: <000401c826d4$da90e3f0$802b3b52@utente5b43c700> From: "LEVASSEUR nee" To: Subject: riotoxic Date: Wed, 14 Nov 2007 16:41:42 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C826DD.3C554BF0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Antivirus: avast! (VPS 071113-1, 13/11/2007), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 3.1 (+++) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 ------=_NextPart_000_0004_01C826DD.3C554BF0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable put yourself into a class of your own with a larger penis zarelitu misztal http://aipte.com/ ------=_NextPart_000_0004_01C826DD.3C554BF0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
put yourself into a class of your own with a = larger penis
zarelitu misztal
http://aipte.com/
------=_NextPart_000_0004_01C826DD.3C554BF0-- From RobertaoffstageBingham@suburbanchicagonews.com Wed Nov 14 11:01:38 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsKgM-0005vV-3v; Wed, 14 Nov 2007 11:01:38 -0500 Received: from dxb-as46039.alshamil.net.ae ([217.165.55.65] helo=user) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsKgL-00024e-Fw; Wed, 14 Nov 2007 11:01:38 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host02495650.suburbanchicagonews.com (8.13.1/8.13.1) with SMTP id 5tVJkdBs92.064444.Z8U.ciK.6637359517780 for ; Wed, 14 Nov 2007 20:01:10 -0400 Message-ID: <702f301c826d7$a0365ac0$6401a8c0@USER> From: "Katie Forrest" To: Subject: Your life Date: Wed, 14 Nov 2007 20:01:10 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_702EF_01C826D7.A0365AC0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_702EF_01C826D7.A0365AC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_702EF_01C826D7.A0365AC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_702EF_01C826D7.A0365AC0-- From ipsec-bounces@ietf.org Wed Nov 14 12:11:49 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsLlh-0008OO-Ud; Wed, 14 Nov 2007 12:11:13 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IsLlg-0008Mj-JB for ipsec-confirm+ok@megatron.ietf.org; Wed, 14 Nov 2007 12:11:12 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsLlg-0008Lk-7k for ipsec@lists.ietf.org; Wed, 14 Nov 2007 12:11:12 -0500 Received: from elasmtp-spurfowl.atl.sa.earthlink.net ([209.86.89.66]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IsLlb-0000qN-U1 for ipsec@lists.ietf.org; Wed, 14 Nov 2007 12:11:12 -0500 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=ix.netcom.com; b=Vpc0/4nlFem6Di5AJqH5fMlPi0yChxRN5BcXnRcXW3HENoBodQMEemn/xz1gqqEK; h=Message-ID:Date:From:Reply-To:To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.37] (helo=elwamui-karabash.atl.sa.earthlink.net) by elasmtp-spurfowl.atl.sa.earthlink.net with asmtp (Exim 4.34) id 1IsLl7-0001YQ-RD; Wed, 14 Nov 2007 12:10:48 -0500 Received: from 216.31.249.246 by webmail.pas.earthlink.net with HTTP; Wed, 14 Nov 2007 12:10:35 -0500 Message-ID: <26383796.1195060235490.JavaMail.root@elwamui-karabash.atl.sa.earthlink.net> Date: Wed, 14 Nov 2007 09:10:35 -0800 (GMT-08:00) From: "Scott G. Kelly" To: Michael Richardson , ipsec@lists.ietf.org Subject: Re: [IPsec] test vectors for IKEv2 SKEYSEED derivation Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: EarthLink Zoo Mail 1.0 X-ELNK-Trace: 5b98cdd91c374dcd776432462e451d7bd15d05d9470ff71072b08de8217d27a01db6f703a9df8caf350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.37 X-Spam-Score: 0.0 (/) X-Scan-Signature: ccfb4541e989aa743998098cd315d0fd Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: "Scott G. Kelly" List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Hi Michael, To generate the sha256 test vectors, I grabbed the reference code that is documented in RFC 4634 (US Secure Hash Algorithms (SHA and HMAC-SHA)), put it into files, replaced the main function, added a few other knobs, and built it. I have a tgz file I can send you if interested. Scott -----Original Message----- >From: Michael Richardson >Sent: Nov 13, 2007 9:33 PM >To: ipsec@lists.ietf.org >Subject: [IPsec] test vectors for IKEv2 SKEYSEED derivation > >I'm looking for some test vectors for SKEYSEED calculation. I asked google a >bit, but I didn't find anything published on the IPsec list. Perhaps there >are some materials from one of the bakeoffs. I wish that we had put some >vectors into rfc4306. I saw that there are some vectors in the SHA256 drafts, >but I don't think that they give enough detail to confirm that an >implementation has done the right thing. >Obviously, I'm going to try interoperating, but it isn't always easy to find >the error in the calculation when looking a black box. > >If someone would be willing the confirm my calculations, my inputs and output >are listed below, or in C-hex files at: > >http://git.openswan.org/cgi-bin/gitweb.cgi?p=openswan.git;a=blob;f=testing/lib/libpluto/seam_gi.c;h=cfaa33012e3e3506e7cf62f5a64a7ca6b51d7a98;hb=7a2a3bf55fc19df377e78ea61673d74656ece8b0 >http://git.openswan.org/cgi-bin/gitweb.cgi?p=openswan.git;a=blob;f=testing/lib/libpluto/seam_gi_sha1.c;h=e980dabd5cc17b3f12b56085ac7f09eccf60f861;hb=9d417f4bb2ebb4333dda6e228e7bc0eae834f61a > >For instance, this is my calculation with MD5 as the PRF, >HMAC-MD5 as the intended auth and 3DES as the intended cipher for >the PARENT_SA. (I.e. 128 bits required for SK_a and SK_p, and 192 bits for SK_e). > >(THESE ARE NOT CONFIRMED!!!) > > > >| spii 75 46 d3 d6 ea 09 f7 df >| spir 61 a6 78 6a 41 ea 48 06 >| ni b5 ce 84 19 09 5c 6e 2b 6b 62 d3 05 53 05 b3 c4 >| nr 47 e9 f9 25 8c a2 38 58 f6 75 b1 66 b0 2c c2 92 >| gi ff bc 6a 92 a6 b9 55 9b 05 fa 96 a7 a4 35 07 b4 >| c1 e1 c0 86 1a 58 71 d9 ba 73 a1 63 11 37 88 c0 >| de bb 39 79 e7 ff 0c 52 b4 ce 60 50 eb 05 36 9e >| a4 30 0d 2b ff 3b 1b 29 9f 3b 80 2c cb 13 31 8c >| 2a b9 e3 b5 62 7c b4 b3 5e b9 39 98 20 76 b5 7c >| 05 0d 7b 35 c3 c5 c7 cc 8c 0f ea b7 b6 4a 7d 7b >| 6b 8f 6b 4d ab f4 ac 40 6d d2 01 26 b9 0a 98 ac >| 76 6e fa 37 a7 89 0c 43 94 ff 9a 77 61 5b 58 f5 >| 2d 65 1b bf a5 8d 2a 54 9a f8 b0 1a a4 bc a3 d7 >| 62 42 66 63 b1 55 d4 eb da 9f 60 a6 a1 35 73 e6 >| a8 88 13 5c dc 67 3d d4 83 02 99 03 f3 a9 0e ca >| 23 e1 ec 1e 27 03 31 b2 d0 50 f4 f7 58 f4 99 27 >| gr cd 30 df 6e c0 85 44 12 53 01 80 d8 7e 1a fb b3 >| 26 79 3e 99 56 c8 6a 96 25 53 c2 77 ad 5b ab 50 >| f8 32 5a d8 64 0b 0e fe a5 1d 6c 83 1f a1 7c fb >| 0f 2e 1a f4 b1 66 a0 fe 30 75 12 ad 0f 81 ab b8 >| aa fb 68 48 ec 10 a4 97 6c 3d b1 17 ec e1 e6 61 >| db bf 48 0c 28 2e 3f 11 07 c1 86 42 80 1e e8 3f >| 9e 4a b9 ab 63 6f 23 7d aa f6 a7 aa d8 22 99 3e >| a4 1e a3 31 ee 27 82 0b 93 f5 0b 8f 3f 71 05 61 >| c9 25 70 26 97 ba 6b 1e 95 3c 21 fb c9 a7 7d 2b >| 5f 87 3c fc 50 99 e7 7d 48 4c dd 52 66 4b cf 0d >| bf 00 ca fd ae 6d e7 14 6d 11 35 f6 5d 93 5f 60 >| b9 73 0f e0 49 2c 2a f8 c9 04 f6 4c 59 16 90 9d >| secret 17 9b b3 22 a6 77 6f bc 01 4e 41 03 f0 f6 2e 93 >| fb 07 d0 93 84 57 e4 54 1e 64 46 a9 34 37 c0 9d > >| DH calculation gives: >| c2 e9 1d a2 05 63 19 6e 34 89 df d1 af a5 4a 51 >| 09 4d 76 2e ff bf 39 a6 1a 64 f4 8c 8e fb 0a 4f >| ac 5a a3 18 01 aa 1a cc 94 d6 91 50 96 38 16 8b >| dd 39 19 c3 5e 99 5a 92 3d e3 fa 2c 2d 21 cb 15 >| ac 7a 81 49 ab 37 33 f7 55 a3 25 a0 90 4a 87 bb >| fe 70 71 8b 63 ba af 56 a7 b4 8f 54 d5 0d 17 95 >| 14 f3 09 21 da d6 8c 71 8c d4 82 89 06 c4 24 75 >| 4b 55 4c d9 91 83 ce b6 ad ae 6a 5e 7d bf f9 ef >| ae 60 a7 b7 97 b6 31 50 4e cc 0f ff 17 f1 aa 4b >| 1e 0c 61 71 32 d6 b9 79 58 61 e6 ab f3 67 d8 9e >| 3c db 68 3e ff 9e 37 ea 67 70 21 0e 07 ea b6 2b >| 72 30 ea 5d 55 86 9a 04 86 ed e1 c7 bd ee 61 84 > >| skeyseed: 35 8e b1 84 d9 02 7e a2 a3 b3 e6 08 b9 2f 5f bf > >| prf+[1]: 52 9a 10 2f 28 df 41 78 6e c2 75 e1 06 3b d2 50 >| prf+[2]: 3e 43 b9 a8 f8 4e b0 2b a1 be 33 6f 4a 37 da 21 >| prf+[3]: ba 4e fe 1c f0 0a 4d b0 22 02 5d 4f 53 b9 56 45 >| prf+[4]: 50 a9 46 72 7a af fb 5d 8f 85 21 d4 88 eb 84 ec >| prf+[5]: 72 87 28 fe b0 6a 22 c2 83 c5 c2 82 bb f7 d5 b7 >| prf+[6]: 7a dc 9f 0b 1d 32 11 cc 90 22 79 2c 20 b4 93 d6 >| prf+[7]: 18 01 15 e0 86 ce d3 95 6b 1a b1 f7 7b bb 6f 2d >| prf+[8]: c0 47 bc 10 1f d5 b0 e9 b2 9f 74 93 2a 8e c4 3a > >| SK_d: 52 9a 10 2f 28 df 41 78 6e c2 75 e1 06 3b d2 50 >| SK_ai: 3e 43 b9 a8 f8 4e b0 2b a1 be 33 6f 4a 37 da 21 >| SK_ar: ba 4e fe 1c f0 0a 4d b0 22 02 5d 4f 53 b9 56 45 >| SK_ei: 50 a9 46 72 7a af fb 5d 8f 85 21 d4 88 eb 84 ec >| 72 87 28 fe b0 6a 22 c2 >| SK_er: 83 c5 c2 82 bb f7 d5 b7 7a dc 9f 0b 1d 32 11 cc >| 90 22 79 2c 20 b4 93 d6 >| SK_pi: 18 01 15 e0 86 ce d3 95 6b 1a b1 f7 7b bb 6f 2d >| SK_pr: c0 47 bc 10 1f d5 b0 e9 b2 9f 74 93 2a 8e c4 3a > > >And for AES128 and SHA1: >| spii 75 46 d3 d6 ea 09 f7 df >| spir 61 a6 78 6a 41 ea 48 06 >| ni b5 ce 84 19 09 5c 6e 2b 6b 62 d3 05 53 05 b3 c4 >| nr 47 e9 f9 25 8c a2 38 58 f6 75 b1 66 b0 2c c2 92 >| gi ff bc 6a 92 a6 b9 55 9b 05 fa 96 a7 a4 35 07 b4 >| c1 e1 c0 86 1a 58 71 d9 ba 73 a1 63 11 37 88 c0 >| de bb 39 79 e7 ff 0c 52 b4 ce 60 50 eb 05 36 9e >| a4 30 0d 2b ff 3b 1b 29 9f 3b 80 2c cb 13 31 8c >| 2a b9 e3 b5 62 7c b4 b3 5e b9 39 98 20 76 b5 7c >| 05 0d 7b 35 c3 c5 c7 cc 8c 0f ea b7 b6 4a 7d 7b >| 6b 8f 6b 4d ab f4 ac 40 6d d2 01 26 b9 0a 98 ac >| 76 6e fa 37 a7 89 0c 43 94 ff 9a 77 61 5b 58 f5 >| 2d 65 1b bf a5 8d 2a 54 9a f8 b0 1a a4 bc a3 d7 >| 62 42 66 63 b1 55 d4 eb da 9f 60 a6 a1 35 73 e6 >| a8 88 13 5c dc 67 3d d4 83 02 99 03 f3 a9 0e ca >| 23 e1 ec 1e 27 03 31 b2 d0 50 f4 f7 58 f4 99 27 >| gr cd 30 df 6e c0 85 44 12 53 01 80 d8 7e 1a fb b3 >| 26 79 3e 99 56 c8 6a 96 25 53 c2 77 ad 5b ab 50 >| f8 32 5a d8 64 0b 0e fe a5 1d 6c 83 1f a1 7c fb >| 0f 2e 1a f4 b1 66 a0 fe 30 75 12 ad 0f 81 ab b8 >| aa fb 68 48 ec 10 a4 97 6c 3d b1 17 ec e1 e6 61 >| db bf 48 0c 28 2e 3f 11 07 c1 86 42 80 1e e8 3f >| 9e 4a b9 ab 63 6f 23 7d aa f6 a7 aa d8 22 99 3e >| a4 1e a3 31 ee 27 82 0b 93 f5 0b 8f 3f 71 05 61 >| c9 25 70 26 97 ba 6b 1e 95 3c 21 fb c9 a7 7d 2b >| 5f 87 3c fc 50 99 e7 7d 48 4c dd 52 66 4b cf 0d >| bf 00 ca fd ae 6d e7 14 6d 11 35 f6 5d 93 5f 60 >| b9 73 0f e0 49 2c 2a f8 c9 04 f6 4c 59 16 90 9d >| secret 17 9b b3 22 a6 ab cd ef 01 4e 41 03 f2 f6 2e 93 >| fb 07 d4 93 84 57 e4 54 1e 64 46 a9 34 37 c4 9d > >| DH calculation gives: >| 60 76 62 71 0c 76 fe 27 4f 6f 7c 9f 68 cf cf e0 >| a7 56 44 cb a1 92 2a b9 c9 c2 16 0e a7 80 d0 71 >| 50 06 87 10 85 f0 80 30 58 c4 2e c9 d6 ae 4f 53 >| 41 b6 2b 7c 66 8d 9f ba 20 15 5a 7c 23 60 e6 22 >| 03 55 a0 80 3b c9 11 a5 6f c7 30 0d d7 f6 6b 01 >| c4 88 ab 8f 79 1a d2 cc 58 8d 28 c0 c0 78 fa 61 >| 21 d5 88 1b 3a e9 b4 a7 d8 c9 a6 58 60 6e 0a 2a >| 5e 9c 5f 9e c2 b5 0b 63 d7 af bb 80 f4 a4 83 37 >| ce de f5 aa 6f a1 a0 f3 af c3 21 47 19 2c 7f ba >| 7e 27 9f 00 28 81 21 cb 3d e7 f1 d9 76 fd f1 6c >| 99 28 db 95 92 38 f7 83 a4 fd 38 75 7e 55 2c e9 >| 2d db d6 f5 0c 1d 35 af 77 34 fc 85 cb 30 b8 09 > >| skeyseed: 9d 8e 53 96 0b 36 01 f4 c0 d3 29 ee 1e c3 70 27 >| 0d 06 22 17 > >| prf+[1]: ac 97 eb 39 07 53 a4 5d 61 c1 64 ff ca 25 99 b0 >| 2e 05 3c 7e >| prf+[2]: 4e a8 e6 62 b0 7c dd 43 0f 69 44 c6 72 3e 4b 82 >| d5 72 24 18 >| prf+[3]: 51 5b 0b d2 2e 6d 76 b3 4f db 76 0a a7 bf ad 80 >| b1 09 b7 5d >| prf+[4]: 3f 44 bf 47 ca fd 81 50 59 1d eb 08 81 99 fc bf >| be db 67 ec >| prf+[5]: 7d c3 d0 0c cc ac 42 e7 0c d6 3b de cc 07 97 44 >| b4 a3 4e 8a >| prf+[6]: 0d 2f 27 8b ee 06 6d 07 a5 a5 75 2e e9 00 11 7e >| 41 d4 31 62 >| prf+[7]: 40 b8 63 22 bf 06 9f bc eb 81 58 e7 6a 49 14 75 >| 56 d3 3c 8e >| SK_d: ac 97 eb 39 07 53 a4 5d 61 c1 64 ff ca 25 99 b0 >| 2e 05 3c 7e >| SK_ai: 4e a8 e6 62 b0 7c dd 43 0f 69 44 c6 72 3e 4b 82 >| d5 72 24 18 >| SK_ar: 51 5b 0b d2 2e 6d 76 b3 4f db 76 0a a7 bf ad 80 >| b1 09 b7 5d >| SK_ei: 3f 44 bf 47 ca fd 81 50 59 1d eb 08 81 99 fc bf >| SK_er: be db 67 ec 7d c3 d0 0c cc ac 42 e7 0c d6 3b de >| SK_pi: cc 07 97 44 b4 a3 4e 8a 0d 2f 27 8b ee 06 6d 07 >| a5 a5 75 2e >| SK_pr: e9 00 11 7e 41 d4 31 62 40 b8 63 22 bf 06 9f bc >| eb 81 58 e7 > > > > >_______________________________________________ >IPsec mailing list >IPsec@ietf.org >https://www1.ietf.org/mailman/listinfo/ipsec _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From LatonyaguianaSumner@switchboard.com Wed Nov 14 14:12:31 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsNf5-00075N-OG; Wed, 14 Nov 2007 14:12:31 -0500 Received: from adsl190-28-222-243.epm.net.co ([190.28.222.243] helo=juan) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsNf4-0007K8-RO; Wed, 14 Nov 2007 14:12:31 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host21094605.switchboard.com (8.13.1/8.13.1) with SMTP id G1i9Wtr590.063663.G3f.LCi.2817848655723 for ; Wed, 14 Nov 2007 14:11:52 +0500 Message-ID: <74d601c826f2$49158f70$0301010a@JUAN> From: "Maude Joiner" To: Subject: Approval process Date: Wed, 14 Nov 2007 14:11:52 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_74D2_01C826F2.49158F70" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 This is a multi-part message in MIME format. ------=_NextPart_000_74D2_01C826F2.49158F70 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_74D2_01C826F2.49158F70 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_74D2_01C826F2.49158F70-- From AileenchooseNapier@rotax-owner.com Wed Nov 14 15:15:40 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsOeC-0003ql-9V; Wed, 14 Nov 2007 15:15:40 -0500 Received: from 39.red-88-27-2.staticip.rima-tde.net ([88.27.2.39] helo=nombrea8239141) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsOeB-0007l0-Gj; Wed, 14 Nov 2007 15:15:40 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host31417419.rotax-owner.com (8.13.1/8.13.1) with SMTP id ubJU3ixC02.399784.IFU.uqQ.0147574777679 for ; Wed, 14 Nov 2007 21:15:15 -0100 Message-ID: From: "Willa Schmitz" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_B02F_01C826FB.1DA55380-- From MarcbloomCastillo@aahoa.com Wed Nov 14 19:34:08 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsSgJ-0002rn-00; Wed, 14 Nov 2007 19:34:08 -0500 Received: from host86-135-199-240.range86-135.btcentralplus.com ([86.135.199.240] helo=yourv7oy5l24pg.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsSgI-0001gY-H3; Wed, 14 Nov 2007 19:34:06 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host49184864.aahoa.com (8.13.1/8.13.1) with SMTP id w9Cg7JR381.273396.vYQ.99l.1794335729830 for ; Thu, 15 Nov 2007 00:33:43 +0000 Message-ID: <6cf601c8271f$399d78f0$4001a8c0@yourv7oy5l24pg> From: "Nathaniel Gutierrez" To: Subject: Hi Date: Thu, 15 Nov 2007 00:33:43 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_6CF2_01C8271F.399D78F0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_6CF2_01C8271F.399D78F0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_6CF2_01C8271F.399D78F0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_6CF2_01C8271F.399D78F0-- From WilliscommodoreReeves@driver-repository.be Wed Nov 14 20:36:52 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsTf2-0005V4-Db; Wed, 14 Nov 2007 20:36:52 -0500 Received: from [41.249.9.206] (helo=unicorni18fdd8) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsTf1-0003hI-8P; Wed, 14 Nov 2007 20:36:52 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host78333995.driver-repository.be (8.13.1/8.13.1) with SMTP id x7E5Oua351.748842.d0F.dio.6648397964011 for ; Thu, 15 Nov 2007 01:36:13 +0000 Message-ID: <380ed01c82727$fd7489a0$0202a8c0@unicorni18fdd8> From: "Blake Burgess" To: Subject: Your health Date: Thu, 15 Nov 2007 01:36:13 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_380E9_01C82727.FD7489A0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_380E9_01C82727.FD7489A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_380E9_01C82727.FD7489A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_380E9_01C82727.FD7489A0-- From IrvinpolaroidCasey@porscheclub.com Wed Nov 14 21:39:04 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsUdE-0003Jd-BV; Wed, 14 Nov 2007 21:39:04 -0500 Received: from pool-71-123-228-153.dllstx.fios.verizon.net ([71.123.228.153] helo=your03667082de) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsUdE-0005Zf-3Y; Wed, 14 Nov 2007 21:39:04 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host77374649.porscheclub.com (8.13.1/8.13.1) with SMTP id WFIO3I3S37.284519.cGA.GgQ.9027003093047 for ; Wed, 14 Nov 2007 20:38:42 +0600 Message-ID: <3cd7601c82730$aec8d550$6500a8c0@your03667082de> From: "Darin Lamb" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_3CD72_01C82730.AEC8D550-- From EganMatevosian@Freefall.com Wed Nov 14 23:26:48 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsWJU-0003Ya-RQ for ipsec-archive@lists.ietf.org; Wed, 14 Nov 2007 23:26:48 -0500 Received: from [201.230.191.249] (helo=client-201.230.191.249.speedy.net.pe) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IsWJU-0000El-Aw for ipsec-archive@lists.ietf.org; Wed, 14 Nov 2007 23:26:48 -0500 Received: by 10.101.189.20 with SMTP id xAcnkhhEGUTxP; Wed, 14 Nov 2007 23:26:56 -0500 (GMT) Received: by 192.168.235.6 with SMTP id oNgURjiSHJlncW.8334590541914; Wed, 14 Nov 2007 23:26:54 -0500 (GMT) Message-ID: <000e01c8273f$be88d300$f9bfe6c9@sandra> From: "Egan Matevosian" To: Subject: egnehaam Date: Wed, 14 Nov 2007 23:26:51 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C82715.D5B2CB00" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 3.0 (+++) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 ------=_NextPart_000_0004_01C82715.D5B2CB00 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable yes she does want a solid piece of meat shoved between her legs roilui Georgekish http://alborzit.com/ ------=_NextPart_000_0004_01C82715.D5B2CB00 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
yes she does want a solid piece of meat shoved = between=20 her legs
roilui Georgekish
http://alborzit.com/
------=_NextPart_000_0004_01C82715.D5B2CB00-- From BernadetteficheMccain@interfax.ru Thu Nov 15 05:23:41 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Isbsr-00028n-Nu; Thu, 15 Nov 2007 05:23:41 -0500 Received: from 213-140-17-104.ip.fastwebnet.it ([213.140.17.104] helo=utente890195a5.residential.fw) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Isbsr-0004dB-Bn; Thu, 15 Nov 2007 05:23:41 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host77911362.interfax.ru (8.13.1/8.13.1) with SMTP id 309jfJv580.208029.ZPE.RX6.1396685372461 for ; Thu, 15 Nov 2007 11:23:16 -0100 Message-ID: <63cd01c82771$9515f110$bb2aec1d@utente890195a5> From: "Blanca Miner" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_63C9_01C82771.9515F110-- From AuroradespondCope@supremecourthistory.org Thu Nov 15 06:29:12 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IscuF-0000dI-TW; Thu, 15 Nov 2007 06:29:11 -0500 Received: from nc-71-51-241-159.dhcp.embarqhsd.net ([71.51.241.159] helo=bonusroom) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IscuF-0006sE-Hr; Thu, 15 Nov 2007 06:29:11 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host47682856.supremecourthistory.org (8.13.1/8.13.1) with SMTP id gatrEdx947.842031.85V.ICm.8598186926263 for ; Thu, 15 Nov 2007 06:28:38 +0500 Message-ID: <955d701c8277a$b72bbf10$0202a8c0@BONUSROOM> From: "Cara Feldman" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_955D3_01C8277A.B72BBF10-- From ClaudettearcaneBarajas@rulers.org Thu Nov 15 07:29:11 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsdqJ-0005fX-Cw; Thu, 15 Nov 2007 07:29:11 -0500 Received: from static-adsl201-232-93-217.epm.net.co ([201.232.93.217] helo=empresa68b72bd) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsdqI-0000d9-MR; Thu, 15 Nov 2007 07:29:11 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host43167795.rulers.org (8.13.1/8.13.1) with SMTP id xSQJrUDI06.908165.MTL.Mbc.9055518711954 for ; Thu, 15 Nov 2007 07:28:20 +0500 Message-ID: <49b701c82783$19dc34c0$0201010a@empresa68b72bd> From: "Frieda Diamond" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_49B3_01C82783.19DC34C0-- From hirokilachlan2@chaosmagic.com Thu Nov 15 08:03:26 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IseNS-0002zt-BB for ipsec-archive@lists.ietf.org; Thu, 15 Nov 2007 08:03:26 -0500 Received: from 253.red-81-32-133.dynamicip.rima-tde.net ([81.32.133.253]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IseNR-0002FC-SO for ipsec-archive@lists.ietf.org; Thu, 15 Nov 2007 08:03:26 -0500 Received: from [81.32.133.253] by bkcavsh.chaosmagic.com; Thu, 15 Nov 2007 13:03:23 +0000 Message-ID: <000601c82787$046e50f9$6e06479b@shcvmm> From: "archibald aneliese" To: "Jarvis Mcnamara" Subject: Shop around for luxury items Date: Thu, 15 Nov 2007 11:16:01 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C82787.04693440" X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 ------=_NextPart_000_0003_01C82787.04693440 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Replica Rolex Watches and More…Great Products, Great Prices!=20 http://popullatrave.net/ ------=_NextPart_000_0003_01C82787.04693440 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Replica Rolex Watches and More…Great Products, Great Prices! =

http://popullatrave.net/ ------=_NextPart_000_0003_01C82787.04693440-- From LolitashinMclain@supremecourthistory.org Thu Nov 15 10:12:04 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsgNw-0000Ce-Cb; Thu, 15 Nov 2007 10:12:04 -0500 Received: from pool-71-125-29-80.nycmny.fios.verizon.net ([71.125.29.80] helo=your55e5f9e3d2) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsgNw-00008q-47; Thu, 15 Nov 2007 10:12:04 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host18848562.supremecourthistory.org (8.13.1/8.13.1) with SMTP id Hrq43Hup24.096039.33H.4Hp.6501603532016 for ; Thu, 15 Nov 2007 10:11:39 +0500 Message-ID: <5038a01c82799$dd92e3d0$6600a8c0@your55e5f9e3d2> From: "Bertie Hemphill" To: Subject: Hi Date: Thu, 15 Nov 2007 10:11:39 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_50386_01C82799.DD92E3D0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_50386_01C82799.DD92E3D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_50386_01C82799.DD92E3D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_50386_01C82799.DD92E3D0-- From ipsec-bounces@ietf.org Thu Nov 15 10:17:02 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsgSb-0006iC-CA; Thu, 15 Nov 2007 10:16:53 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IsgSa-0006gu-Ad for ipsec-confirm+ok@megatron.ietf.org; Thu, 15 Nov 2007 10:16:52 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsgSZ-0006gZ-NU for ipsec@lists.ietf.org; Thu, 15 Nov 2007 10:16:51 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IsgSV-0008LJ-Ev for ipsec@lists.ietf.org; Thu, 15 Nov 2007 10:16:51 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1IsgOc-0004sM-Pe for ipsec@lists.ietf.org; Thu, 15 Nov 2007 15:12:46 +0000 Received: from desk.marajade.sandelman.ca ([209.87.252.247]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 15 Nov 2007 15:12:46 +0000 Received: from mcr by desk.marajade.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 15 Nov 2007 15:12:46 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Thu, 15 Nov 2007 10:08:44 -0500 Lines: 18 Message-ID: References: <1194971503.2477.685.camel@faith.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: desk.marajade.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070510 Iceape/1.0.9 (Debian-1.0.9-0etch1) In-Reply-To: <1194971503.2477.685.camel@faith.austin.ibm.com> X-Spam-Score: -0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Cc: Subject: [IPsec] Re: ESP's use of dummy packets? X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Joy Latten wrote: > RFC 4303 introduces the use of dummy packets within ESP. > Section 2.6 states, > A transmitter MUST be capable of generating dummy packets marked > with this value in the next protocol field, and a receiver MUST > be prepared to discard such packets, without indicating an error. > > However, it is not clear to me whether an IPsec/ESP implementation MUST > use this feature. That is, it MUST send out dummy packets at random > intervals or in a way to shape the traffic. I interpreted the above > statement to mean that an implementation must only have the capability. That's correct. You had better be able to discard them if the other end sends them, though. Which means you'll have to test that. Which means that you'll have to find a way to generate them in your lab... so it means that you'll wind up having to implement it anyway. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Thu Nov 15 10:17:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsgSu-00073i-1C; Thu, 15 Nov 2007 10:17:12 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IsgSs-00072P-LG for ipsec-confirm+ok@megatron.ietf.org; Thu, 15 Nov 2007 10:17:10 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsgSs-00072F-BW for ipsec@lists.ietf.org; Thu, 15 Nov 2007 10:17:10 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IsgSp-0008NH-29 for ipsec@lists.ietf.org; Thu, 15 Nov 2007 10:17:10 -0500 Received: from root by ciao.gmane.org with local (Exim 4.43) id 1IsgQo-0005ji-Rr for ipsec@lists.ietf.org; Thu, 15 Nov 2007 15:15:02 +0000 Received: from desk.marajade.sandelman.ca ([209.87.252.247]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 15 Nov 2007 15:15:02 +0000 Received: from mcr by desk.marajade.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 15 Nov 2007 15:15:02 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Thu, 15 Nov 2007 10:10:58 -0500 Lines: 14 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: desk.marajade.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070510 Iceape/1.0.9 (Debian-1.0.9-0etch1) In-Reply-To: X-Spam-Score: -0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Cc: Subject: [IPsec] Re: About PFS for first CHILD_SA X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Black_David@emc.com wrote: > Anil, > >> I would like to know how PFS is achieved for first CHILD_SA that is >> created as part of piggyback in AUTH exchange. > > PFS against what? The IKE SA and the first child SA are created at > essentially the same time. There isn't anything previous against > which to provide forward secrecy. Yes, it is a bit more efficient in IKEv2. In IKEv1, if PFS is enabled, then a new DH is done, even for the first "phase 2" SA. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Thu Nov 15 10:46:26 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Isgv9-0002ya-3k; Thu, 15 Nov 2007 10:46:23 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Isgv8-0002xh-07 for ipsec-confirm+ok@megatron.ietf.org; Thu, 15 Nov 2007 10:46:22 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Isgv7-0002xR-K1 for ipsec@ietf.org; Thu, 15 Nov 2007 10:46:21 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Isgv6-0001ok-Cn for ipsec@ietf.org; Thu, 15 Nov 2007 10:46:21 -0500 Received: from [91.90.139.103] (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lAFFkJ6a019312; Thu, 15 Nov 2007 17:46:19 +0200 (IST) Message-ID: <473C69CB.9020709@checkpoint.com> Date: Thu, 15 Nov 2007 17:46:19 +0200 From: Yaron Sheffer User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: "ietf-ipsec-failover@vpnc.org" , ipsec@ietf.org Content-Type: multipart/mixed; boundary="------------060009010203030003090708" X-Spam-Score: 0.0 (/) X-Scan-Signature: b045c2b078f76b9f842d469de8a32de3 Cc: Subject: [IPsec] [Fwd: I-D Action:draft-sheffer-ipsec-failover-01.txt] X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org This is a multi-part message in MIME format. --------------060009010203030003090708 Content-Type: multipart/alternative; boundary="------------080507090101000807060209" --------------080507090101000807060209 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit FYI, a new version of our IPsec failover solution draft. Your comments are welcome! Yaron -------- Original Message -------- Subject: I-D Action:draft-sheffer-ipsec-failover-01.txt Date: Thu, 15 Nov 2007 04:50:02 -0500 From: Internet-Drafts@ietf.org Reply-To: internet-drafts@ietf.org To: i-d-announce@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : IPsec Gateway Failover Protocol Author(s) : Y. Sheffer, et al. Filename : draft-sheffer-ipsec-failover-01.txt Pages : 22 Date : 2007-11-15 The Internet Key Exchange version 2 (IKEv2) protocol has computational and communication overhead with respect to the number of round-trips required and cryptographic operations involved. In remote access situations, the Extensible Authentication Protocol is used for authentication, which adds additional latency. To re-establish security associations (SA) upon a failure recovery condition is time consuming, especially when an IPsec peer, such as a VPN gateway, needs to re-establish a large number of SAs with various end points. A high number of concurrent sessions might cause additional problems for an IPsec peer during SA re-establishment. In many failure cases it would be useful to provide an efficient way to resume an interrupted IKE/IPsec session. This document proposes an extension to IKEv2 that allows a client to re-establish an IKE SA with a gateway in a highly efficient manner, utilizing a previously established IKE SA. A client can reconnect to a gateway from which it was disconnected, or alternatively migrate to another gateway that is associated with the previous one. The proposed approach conveys IKEv2 state information, in the form of an encrypted ticket, to a VPN client that is later presented to the VPN gateway for re-authentication. An encrypted ticket cannot be decrypted by a VPN client but allows a VPN gateway to restore state for faster session state setup. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-sheffer-ipsec-failover-01.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-sheffer-ipsec-failover-01.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-sheffer-ipsec-failover-01.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --------------080507090101000807060209 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit

FYI, a new version of our IPsec failover solution draft. Your comments are welcome!


    Yaron


-------- Original Message --------
Subject: I-D Action:draft-sheffer-ipsec-failover-01.txt
Date: Thu, 15 Nov 2007 04:50:02 -0500
From: Internet-Drafts@ietf.org
Reply-To: internet-drafts@ietf.org
To: i-d-announce@ietf.org 


A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : IPsec Gateway Failover Protocol
	Author(s)       : Y. Sheffer, et al.
	Filename        : draft-sheffer-ipsec-failover-01.txt
	Pages           : 22
	Date            : 2007-11-15

The Internet Key Exchange version 2 (IKEv2) protocol has
computational and communication overhead with respect to the number
of round-trips required and cryptographic operations involved.  In
remote access situations, the Extensible Authentication Protocol is
used for authentication, which adds additional latency.

To re-establish security associations (SA) upon a failure recovery
condition is time consuming, especially when an IPsec peer, such as a
VPN gateway, needs to re-establish a large number of SAs with various
end points.  A high number of concurrent sessions might cause
additional problems for an IPsec peer during SA re-establishment.

In many failure cases it would be useful to provide an efficient way
to resume an interrupted IKE/IPsec session.  This document proposes
an extension to IKEv2 that allows a client to re-establish an IKE SA
with a gateway in a highly efficient manner, utilizing a previously
established IKE SA.

A client can reconnect to a gateway from which it was disconnected,
or alternatively migrate to another gateway that is associated with
the previous one.  The proposed approach conveys IKEv2 state
information, in the form of an encrypted ticket, to a VPN client that
is later presented to the VPN gateway for re-authentication.  An
encrypted ticket cannot be decrypted by a VPN client but allows a VPN
gateway to restore state for faster session state setup.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-sheffer-ipsec-failover-01.txt

To remove yourself from the I-D Announcement list, send a message to
i-d-announce-request@ietf.org with the word unsubscribe in the body of 
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then
	"get draft-sheffer-ipsec-failover-01.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-sheffer-ipsec-failover-01.txt".

NOTE:   The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
--------------080507090101000807060209-- --------------060009010203030003090708 Content-Type: Message/External-body; name="draft-sheffer-ipsec-failover-01.txt" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="draft-sheffer-ipsec-failover-01.txt" Content-Type: text/plain Content-ID: <2007-11-15044341.I-D\@ietf.org> --------------060009010203030003090708 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --------------060009010203030003090708-- From clx@tnii.com Thu Nov 15 14:56:30 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IskpA-0001m1-MQ; Thu, 15 Nov 2007 14:56:28 -0500 Received: from eos17.neoplus.adsl.tpnet.pl ([83.20.34.17] helo=admin-dd9eb8323) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iskp6-0004Yo-Lj; Thu, 15 Nov 2007 14:56:28 -0500 Received: from [83.20.34.17] by smtp15.msoutlookonline.net; Thu, 15 Nov 2007 21:09:47 +0100 Message-ID: <01c827cb$da315690$11221453@clx> From: "Jessika Reyna" To: Subject: get a puffy shlong Kayla Date: Thu, 15 Nov 2007 21:09:47 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-2" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2527 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 X-Spam-Score: 2.1 (++) X-Scan-Signature: 0f1ff0b0158b41ac6b9548d0972cdd31 beaconfc . com From AntwanlaughCote@spearsmfg.com Thu Nov 15 17:51:01 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IsnY5-0007cX-HP; Thu, 15 Nov 2007 17:51:01 -0500 Received: from 62-31-38-21.cable.ubr12.brad.blueyonder.co.uk ([62.31.38.21] helo=reborn) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IsnY4-0003Td-SI; Thu, 15 Nov 2007 17:51:01 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host01794519.spearsmfg.com (8.13.1/8.13.1) with SMTP id vHMf1Mac43.667143.ywg.fIY.4075616229269 for ; Thu, 15 Nov 2007 22:50:49 +0000 Message-ID: <0b6d01c827da$0320e3a0$15261f3e@reborn> From: "Ahmad Acevedo" To: Subject: Confirmation link Date: Thu, 15 Nov 2007 22:50:49 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0B69_01C827DA.0320E3A0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_0B69_01C827DA.0320E3A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_0B69_01C827DA.0320E3A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_0B69_01C827DA.0320E3A0-- From ChristiresinReeder@williepbennett.com Fri Nov 16 00:22:29 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Istev-0005V3-Op; Fri, 16 Nov 2007 00:22:29 -0500 Received: from cpe-76-189-49-123.neo.res.rr.com ([76.189.49.123] helo=baker.neo.rr.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Istev-0004ZE-96; Fri, 16 Nov 2007 00:22:29 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host01487372.williepbennett.com (8.13.1/8.13.1) with SMTP id QDLsKTFV87.230351.obP.1en.3117536440420 for ; Fri, 16 Nov 2007 00:22:10 +0500 Message-ID: <35b7701c82810$ae4feb00$6401a8c0@baker> From: "Katharine Hooks" To: Subject: Approval process Date: Fri, 16 Nov 2007 00:22:10 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_35B73_01C82810.AE4FEB00" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_35B73_01C82810.AE4FEB00 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_35B73_01C82810.AE4FEB00 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_35B73_01C82810.AE4FEB00-- From RoderickinaugurateMann@linksys.com Fri Nov 16 06:03:33 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Isyyz-0004fY-LX; Fri, 16 Nov 2007 06:03:33 -0500 Received: from ip138-23-208-87.adsl2.versatel.nl ([87.208.23.138] helo=cc19149a1) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Isyyz-0007sr-9i; Fri, 16 Nov 2007 06:03:33 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host38091820.linksys.com (8.13.1/8.13.1) with SMTP id tkeR55VH38.532268.xXR.zab.6256979143952 for ; Fri, 16 Nov 2007 12:02:47 -0100 Message-ID: <64e5101c82840$47b60bb0$0601a8c0@CC19149A1> From: "Kelvin Burgess" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_64E4D_01C82840.47B60BB0-- From AlirhapsodyYork@43people.com Fri Nov 16 08:14:24 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It11c-0006ze-QF; Fri, 16 Nov 2007 08:14:24 -0500 Received: from [212.38.136.208] (helo=yaser) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1It11c-0006qc-00; Fri, 16 Nov 2007 08:14:24 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host18523609.43people.com (8.13.1/8.13.1) with SMTP id rBtezJry97.127973.wFE.Uz9.9445582151291 for ; Fri, 16 Nov 2007 15:13:33 +0800 Message-ID: <10b71301c828a6$5dcf0670$6901a8c0@yaser> From: "Rob Rich" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_10B70F_01C828A6.5DCF0670-- From ipsec-bounces@ietf.org Fri Nov 16 11:13:50 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1It3p4-0007V2-8M; Fri, 16 Nov 2007 11:13:38 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1It3p2-0007Tc-Li for ipsec-confirm+ok@megatron.ietf.org; Fri, 16 Nov 2007 11:13:36 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It3p2-0007TD-9R for ipsec@ietf.org; Fri, 16 Nov 2007 11:13:36 -0500 Received: from mail.ca.certicom.com ([38.113.160.197]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1It3oz-000849-P9 for ipsec@ietf.org; Fri, 16 Nov 2007 11:13:36 -0500 Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id 649EE10027FAF for ; Fri, 16 Nov 2007 11:13:21 -0500 (EST) Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm.certicom.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XJSRHD9-PiZx for ; Fri, 16 Nov 2007 11:13:19 -0500 (EST) Received: from domino1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP for ; Fri, 16 Nov 2007 11:13:19 -0500 (EST) Received: from [10.24.0.104] ([10.24.0.104]) by domino1.certicom.com (Lotus Domino Release 7.0.2FP2 HF177) with ESMTP id 2007111611130385-21480 ; Fri, 16 Nov 2007 11:13:03 -0500 Message-ID: <473DC1D4.5070200@certicom.com> Date: Fri, 16 Nov 2007 11:14:12 -0500 From: Chinh Nguyen User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: ipsec@ietf.org X-MIMETrack: Itemize by SMTP Server on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/16/2007 11:13:03 AM, Serialize by Router on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/16/2007 11:13:05 AM, Serialize complete at 11/16/2007 11:13:05 AM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Spam-Score: -0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Subject: [IPsec] CHILD_SA and PFS X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org As stated in RFC4718, we do not include a DH group in the first CHILD_SA's proposals, due to the fact that no KE payloads are exchanged. This leaves the situation that any mismatch in the "PFS" mode of the peers (on/off) or DH group will not be known until the ipsec SA rekeys. At which time, presumably a NO PROPOSAL CHOSEN will be sent back. However, from a VPN user's perspective, it's not clear which is the more palatable scenario: failure to login (assuming we send the DH group in SAi2) or failure to maintain a VPN session (ipsec rekey fails). Chinh -- http://www.certicom.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From GraceprinceCorbett@tattiebogle.net Fri Nov 16 12:21:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It4sL-0005Ea-QK; Fri, 16 Nov 2007 12:21:05 -0500 Received: from 152-206-222-201.adsl.terra.cl ([201.222.206.152] helo=ciber33h94k903) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1It4sL-0005s3-5a; Fri, 16 Nov 2007 12:21:05 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host30795167.tattiebogle.net (8.13.1/8.13.1) with SMTP id VF5XkfG693.493536.GHA.ncS.9438923540823 for ; Fri, 16 Nov 2007 14:20:36 +0400 Message-ID: From: "Gladys Lyon" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_F2C4_01C82875.0FB95CF0-- From ipsec-bounces@ietf.org Fri Nov 16 13:51:08 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1It6HK-0004la-Ce; Fri, 16 Nov 2007 13:50:58 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1It6HF-00043T-9m for ipsec-confirm+ok@megatron.ietf.org; Fri, 16 Nov 2007 13:50:54 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It6HE-0003va-Im for ipsec@ietf.org; Fri, 16 Nov 2007 13:50:52 -0500 Received: from rv-out-0910.google.com ([209.85.198.191]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1It6HA-0000ja-1g for ipsec@ietf.org; Fri, 16 Nov 2007 13:50:52 -0500 Received: by rv-out-0910.google.com with SMTP id l15so688726rvb for ; Fri, 16 Nov 2007 10:50:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=Qz8PQ99odlYAqIlwiU3Glrtbgjx6Pw9ekC2JsZ3wQIY=; b=nOsv2WrPP+SaaZwf6dlnbTsUMRURfjNwC7potJhSeGldoqxSySgGhnOd917F8A3ot+rQm5qVgG2tPlZ8wUu10nUj/frBvEe5MKwzsI+m2806pexRZ4TSwiFSaYu33tA7ybrykZ7tQpfna3WHy09QuVUnNw/OJZRF6HHnWRwJ6js= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=bYmxKCw3E0E1XHs0aXr0h+xWlHcNO8M+Bi2xWAL5cIv+uHqIOqlMT4o0vIno31krhgH4uwckkftcYLPoGDAqRXKBKDdhLUkFfHfGaPbZpehNaD1NFkTdJq8LclC0w0eL4ePycdwPXnEqMAEh452zNLkPWs3fUt/sl3V680wMP6U= Received: by 10.141.88.3 with SMTP id q3mr816395rvl.1195239045691; Fri, 16 Nov 2007 10:50:45 -0800 (PST) Received: by 10.70.117.20 with HTTP; Fri, 16 Nov 2007 10:50:45 -0800 (PST) Message-ID: <18a603a60711161050i3f8130c2q1316a2876472fb16@mail.gmail.com> Date: Fri, 16 Nov 2007 19:50:45 +0100 From: "Pars Mutaf" To: ipsec@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 343d06d914165ffd9d590a64755216ca Subject: [IPsec] Dictionary-based key exchange (for mobile users) X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Hello, I would very much appreciate some feedback on the following draft (very short). Thanks in advance. Regards, pars --------cut here --------- Network Working Group P. Mutaf Internet-Draft Institut National des Telecommunications Expires: May 19, 2008 November 16, 2007 Dictionary-based Key Exchange draft-mutaf-dke-00.txt Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on May 19, 2008. Copyright Notice Copyright (C) The IETF Trust (2007). Abstract A dictionary-based key exchange protocol is proposed. Two mobile host users that physically meet each other can use this protocol to authenticate each other. PKI nor certificates are not needed. Mutaf Expires May 19, 2008 [Page 1] =0C Internet-Draft Dictionary-based Key Exchange November 2007 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Protocol description . . . . . . . . . . . . . . . . . . . . . 3 3. Security considerations . . . . . . . . . . . . . . . . . . . . 3 4. IANA considerations . . . . . . . . . . . . . . . . . . . . . . 4 5. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 4 6. Informative References . . . . . . . . . . . . . . . . . . . . 4 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 4 Intellectual Property and Copyright Statements . . . . . . . . . . 5 Mutaf Expires May 19, 2008 [Page 2] =0C Internet-Draft Dictionary-based Key Exchange November 2007 1. Introduction A dictionary-based key exchange protocol is proposed. Two mobile host users that physically meet each other can use this protocol to authenticate each other. PKI nor certificates are not needed. 2. Protocol description The proposed protocol is briefly described below: Initiator MitM Responder Request RSA public key PK -----------------------------------------------> PK | <-------------------------------------------- T | | <=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Read 40-bit fingerprint =3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D human verification of 40-bit fingerprint -----------------{secret key}PK ---------------> where PK: a one time RSA public key =3D=3D=3D: voice channel, i.e. responder user tells the fingerpr= int to initiator user through oral communication. MitM: Man in the Middle Figure 1 The octets of the fingerprint will typically be mapped to a dictionary of easy to pronounce and type well-known words. For example, with a dictionary containing 256 words, each octet can be represented with one word in the dictionary, and only 40/8=3D5 words need to be checked. In T time units, MitM has to find a PK' giving the same fingerprint as PK, and returned it to the initiator before PK. 2^40 is large enough to assume that the attacker cannot reasonably succeed. 3. Security considerations TBD. Mutaf Expires May 19, 2008 [Page 3] =0C Internet-Draft Dictionary-based Key Exchange November 2007 4. IANA considerations None. 5. Conclusion This document described a dictionary-based key exchange protocol. The idea of human verification of a public key fingerprint is not new. A 40-bit fingerprint is normally too short and considered insecure (See for example [SB].). In the proposed protocol, however, the fingerprint is used to authenticate a one-time public key that is used to exchange a secret key and possibly other material. 6. Informative References [SB] McCune, J. and J. McCune, "Seeing is Believing", Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA. May 2005. Author's Address Pars Mutaf Institut National des Telecommunications Email: pars.mutaf@gmail.com Mutaf Expires May 19, 2008 [Page 4] =0C Internet-Draft Dictionary-based Key Exchange November 2007 Full Copyright Statement Copyright (C) The IETF Trust (2007). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Intellectual Property The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Acknowledgment Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). Mutaf Expires May 19, 2008 [Page 5] =0C _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Lawlormyr@casaborras.com Fri Nov 16 15:46:39 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It85H-00066q-Tt for ipsec-archive@lists.ietf.org; Fri, 16 Nov 2007 15:46:39 -0500 Received: from [81.214.117.10] (helo=dsl.dynamic8510015876.ttnet.net.tr) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1It85H-0000Ju-9s for ipsec-archive@lists.ietf.org; Fri, 16 Nov 2007 15:46:39 -0500 Received: from as-55d7ab97f690 ([136.167.30.20] helo=as-55d7ab97f690) by dsl.dynamic8510015876.ttnet.net.tr ( sendmail 8.13.3/8.13.1) with esmtpa id 1WADAn-000NJR-wC for ipsec-archive@lists.ietf.org; Fri, 16 Nov 2007 22:46:39 +0200 Message-ID: <000201c82891$c265a770$4c9e6455@as55d7ab97f690> From: "Michelle Lawlor" To: Subject: nesinest Date: Fri, 16 Nov 2007 22:46:27 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01C828A2.85EE7770" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Antivirus: avast! (VPS 071115-0, 15.11.2007), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 0.1 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 ------=_NextPart_000_0006_01C828A2.85EE7770 Content-Type: text/plain; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable Ejaculate further - Fire off like a cannon! antwon laurens http://www.chatvs.com/ ------=_NextPart_000_0006_01C828A2.85EE7770 Content-Type: text/html; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable
Ejaculate further - Fire off like a = cannon!
antwon laurens
http://www.chatvs.com/
------=_NextPart_000_0006_01C828A2.85EE7770-- From LesleycarpetStringer@peoplespot.com Fri Nov 16 16:32:08 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It8nI-00057X-A9; Fri, 16 Nov 2007 16:32:08 -0500 Received: from pool-72-65-3-55.bflony.east.verizon.net ([72.65.3.55] helo=buffaloweimer.myhome.westell.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1It8nH-0002BQ-K2; Fri, 16 Nov 2007 16:32:08 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host43040498.peoplespot.com (8.13.1/8.13.1) with SMTP id cKZR70qW00.607661.aui.jB6.5272528117065 for ; Fri, 16 Nov 2007 16:32:45 +0500 Message-ID: <7d8f01c82898$470c2f20$2f01a8c0@buffaloweimer> From: "Cecile Stacy" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_7D8B_01C82898.470C2F20-- From DonaassemblageLundy@linksys.com Fri Nov 16 17:36:58 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1It9o2-0003dK-AG; Fri, 16 Nov 2007 17:36:58 -0500 Received: from 62.42.127.131.dyn.user.ono.com ([62.42.127.131] helo=ana) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1It9o1-00054g-Rd; Fri, 16 Nov 2007 17:36:58 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host51424575.linksys.com (8.13.1/8.13.1) with SMTP id N12fQE6e24.889981.EkI.Oqr.3292691642927 for ; Fri, 16 Nov 2007 23:36:33 -0100 Message-ID: <38c301c828a1$300af7d0$837f2a3e@ANA> From: "Ericka Kearney" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_38BF_01C828A1.300AF7D0-- From ipsec-bounces@ietf.org Fri Nov 16 17:57:33 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItA7o-0005WL-My; Fri, 16 Nov 2007 17:57:24 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1ItA7n-0005UL-ML for ipsec-confirm+ok@megatron.ietf.org; Fri, 16 Nov 2007 17:57:23 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItA7n-0005U0-B3 for ipsec@ietf.org; Fri, 16 Nov 2007 17:57:23 -0500 Received: from balder-227.proper.com ([192.245.12.227]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ItA7m-0005lc-RO for ipsec@ietf.org; Fri, 16 Nov 2007 17:57:23 -0500 Received: from [10.20.30.108] (adsl-66-125-125-65.dsl.pltn13.pacbell.net [66.125.125.65]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id lAGMvL81036272 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 16 Nov 2007 15:57:22 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: Date: Fri, 16 Nov 2007 14:57:06 -0800 To: IPsec WG From: Internet-Drafts@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Subject: [IPsec] I-D ACTION:draft-mcgrew-gcm-test-00.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Test Cases for the use of Galois/Counter Mode (GCM) and Galois Message Authentication Code (GMAC) in IPsec ESP Author(s) : D. McGrew Filename : draft-mcgrew-gcm-test-00.txt Pages : 27 Date : 2007-11-16 This note provides test cases for the use of AES GCM and GMAC in ESP, as defined in RFC4106 and RFC4543, and clarifies some points in the latter specification. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-mcgrew-gcm-test-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-mcgrew-gcm-test-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-mcgrew-gcm-test-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. [The following attachment must be fetched by mail. Command-click the URL below and send the resulting message to get the attachment.] [The following attachment must be fetched by ftp. Command-click the URL below to ask your ftp client to fetch it.] _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Sat Nov 17 15:02:43 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItTs9-0001VC-9C; Sat, 17 Nov 2007 15:02:33 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1ItTs7-0001Ut-Nm for ipsec-confirm+ok@megatron.ietf.org; Sat, 17 Nov 2007 15:02:31 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItTs7-0001Ug-E1 for ipsec@ietf.org; Sat, 17 Nov 2007 15:02:31 -0500 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ItTs3-0001rE-2r for ipsec@ietf.org; Sat, 17 Nov 2007 15:02:31 -0500 Received: from [165.227.249.203] (dsl-63-249-108-169.cruzio.com [63.249.108.169]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id lAHK2Oc7023062 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 17 Nov 2007 13:02:26 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: Date: Sat, 17 Nov 2007 12:02:08 -0800 To: IPsec WG From: Paul Hoffman Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 Subject: [IPsec] Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org >A New Internet-Draft is available from the on-line Internet-Drafts >directories. > > Title : Internet Key Exchange Protocol: IKEv2 > Author(s) : C. Kaufman, et al. > Filename : draft-hoffman-ikev2bis-02.txt > Pages : 125 > Date : 2007-11-17 > >This document describes version 2 of the Internet Key Exchange (IKE) >protocol. It is a restatement of RFC 4306, and includes all of the >clarifications from RFC 4718. > >A URL for this Internet-Draft is: >http://www.ietf.org/internet-drafts/draft-hoffman-ikev2bis-02.txt Almost all of the changes came from Pasi (thanks, Pasi!). The change list from the document is: Many grammatical fixes. In Section 1.2, reworded Clarif-4.3 to be clearer. In Section 1.3.3, reworded 3.10.1-16393 and Clarif-5.4 to remove redundant text. In Section 2.13, replaced text about variable length keys with clearer explanation and requirement on non-HMAC PRFs. Also added "preferred" to Section 2.14 for the key length, and removed redundant text. In Section 2.14, removed the "half and half" description and replaced it with exceptions for RFC4434 and RFC4615. Removed the now-redundant "All PRFs used with IKEv2 MUST take variable-sized keys" from Section 2.15. In Section 2.15, added "(IKE_SA_INIT response)" after "of the second message" and "(IKE_SA_INIT request)" after "the first message". In Section 2.17, simplified because there are no more bundles. "A single CHILD_SA negotiation may result in multiple security associations. ESP and AH SAs exist in pairs (one in each direction)." becomes "For ESP and AH, a single CHILD_SA negotiation results in two security associations (one in each direction)." In section 3.3, made the example of combinations of algorithms and the contents of the first proposal clearer. Added Clarif-4.4 to the ned of Section 3.3.2. Reordered Section 3.3.5 and added Clarif-7.11. Clarified Section 3.3.6 about choosing a single proposal. Also added second paragraph about transforms not understood, and clarified third paragraph about picking D-H groups. Moved 3.10.1-16392 from Section 3.6 to 3.7. In Section 3.10, clarified 3.10.1-16394. Updated Section 6 to indicate that there is nothing new for IANA in this spec. Also removed the definition of "Expert Review" from Section 1.6 for the same reason. In Appendix A, removed "and not commit any state to an exchange until the initiator can be cryptographically authenticated" because that was only true in an earlier version of IKEv2. --Paul Hoffman, Director --VPN Consortium _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From bcloth@envision.net Sat Nov 17 18:36:32 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItXDE-00048A-7p; Sat, 17 Nov 2007 18:36:32 -0500 Received: from [81.18.53.70] (helo=envision.net) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1ItXD8-0000Ej-Mv; Sat, 17 Nov 2007 18:36:32 -0500 Received: (qmail 37796 invoked from network); Sun, 18 Nov 2007 00:36:28 +0100 Received: from unknown (HELO lezet75ac5e069) (bcloth@envision.net@192.49.73.144) by 46351251envision.net with SMTP; Sun, 18 Nov 2007 00:36:28 +0100 Message-ID: <001301c8297b$0ea46470$01f90514@lezet75ac5e069> From: Madelyn To: imapext-archive@lists.ietf.org Subject: hknee Date: Sun, 18 Nov 2007 00:36:28 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0010_01C8297B.0EA46470" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.3000 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2600.1081 X-Spam-Score: 3.0 (+++) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 This is a multi-part message in MIME format. ------=_NextPart_000_0010_01C8297B.0EA46470 Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable no end but it hasn't given me anything. Yet. I expect that is a musician th= e expression might be a musical score, if the How can we see the artists instinctive physical approach to the ------=_NextPart_000_0010_01C8297B.0EA46470 Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable

forever linked in popular culture. So where does that leave the

A< >re you wan< >ting a bi< >gg< >er p= _ < >e > n _< >is?

As seen on TV

Over 717,000 Men around the world are already satis< >fied
Gain 2+ Inc< >hes In Le< >ng _th
Incr< >ea< >se Your P _e< >n -i< >s Wi _d< >th (Girth) = By u< >p _to 21%
100% Sa< >fe To Take, With NO Side Effects
No Pu< >mps! No Su< >rg< >ery! No Ex< >ercis< >es!
F _< >R< >E >E Bo< >ttles

de< >lop< >aws.co< >m

conclusions and theories. For biologists, computers can produce
= ------=_NextPart_000_0010_01C8297B.0EA46470-- From ernesto06edgar24@coolmail.co.il Sat Nov 17 18:55:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItXVA-0001oK-E8 for ipsec-archive@lists.ietf.org; Sat, 17 Nov 2007 18:55:04 -0500 Received: from [189.179.150.4] (helo=dsl-189-179-150-4.prod-infinitum.com.mx) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ItXV9-0003vU-FC for ipsec-archive@lists.ietf.org; Sat, 17 Nov 2007 18:55:04 -0500 Received: from [189.179.150.4] by sfqqyhoi.coolmail.co.il; Sat, 17 Nov 2007 23:54:56 +0000 Message-ID: <000601c82975$03f55640$880739b5@uyonp> From: "drew septimus" To: "Evelyn Yang" Subject: Look classy without having to spend a bundle Date: Sat, 17 Nov 2007 22:07:34 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C82975.03F40804" X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 ------=_NextPart_000_0003_01C82975.03F40804 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Replica Rolex Watches and More…Great Products, Great Prices!=20 http://prereeraplay.net/ ------=_NextPart_000_0003_01C82975.03F40804 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Replica Rolex Watches and More…Great Products, Great Prices! =

http://prereeraplay.net/ ------=_NextPart_000_0003_01C82975.03F40804-- From paulw@gvrec.org Sun Nov 18 13:48:36 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItpC8-0006ed-5k; Sun, 18 Nov 2007 13:48:36 -0500 Received: from [122.164.152.212] (helo=ABTS-TN-dynamic-212.152.164.122.airtelbroadband.in) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ItpC4-0003ZT-3W; Sun, 18 Nov 2007 13:48:36 -0500 Received: from [122.164.152.212] by gvrec.org; Mon, 19 Nov 2007 00:18:31 +0530 Message-ID: <01c82a41$b6e8a580$d498a47a@paulw> From: "Toni Munson" To: Subject: Galen's man-sized shaft Date: Mon, 19 Nov 2007 00:18:31 +0530 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-2"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2670 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670 X-Spam-Score: 0.6 (/) X-Scan-Signature: 0f1ff0b0158b41ac6b9548d0972cdd31 biclot . com From phybrid@ferroperfil.com Sun Nov 18 15:11:47 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItqUd-0003Bp-ML; Sun, 18 Nov 2007 15:11:47 -0500 Received: from 81-186-239-10.cityconnect.pl ([81.186.239.10]) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1ItqUc-0002uO-KX; Sun, 18 Nov 2007 15:11:47 -0500 Received: from asia ([212.33.240.143]:5695 "HELO asia" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by aefba51ferroperfil.com with ESMTP id 4248F292811944 (ORCPT ); Sun, 18 Nov 2007 21:14:25 +0100 Message-ID: <001001c82a27$ff233e10$000ba7dc@asia> From: Norris Mitchell To: imapext-archive@lists.ietf.org Subject: do december Date: Sun, 18 Nov 2007 21:14:25 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000D_01C82A27.FF233E10" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.181 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2462.3000 X-Spam-Score: 2.1 (++) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 This is a multi-part message in MIME format. ------=_NextPart_000_000D_01C82A27.FF233E10 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable amateur graphic artists will have medium to nun in design skills. context. Often, making THINGS interesting is part of what could be detrime= ntal but for its present use the VR is beneficial ------=_NextPart_000_000D_01C82A27.FF233E10 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable

say you learn form experiences and as a result change or not
<= /P>

Are you wa< >nting a bi< >gger p_ < >e > n = _is?

A< >s s< >een on T< >V

Over 782,000 Men arou< >nd the world are already sa< >tisfied
=
Gain 2+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< = >p _t< >o 25%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcises!
*F _R< >E >< >E B< >m ot< >tles

realities in their own way; that a few select cases cannot
------=_NextPart_000_000D_01C82A27.FF233E10-- From rsbarely@kkafe.net Sun Nov 18 15:12:16 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItqV6-0003LC-SP; Sun, 18 Nov 2007 15:12:16 -0500 Received: from [189.7.68.162] (helo=kkafe.net) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1ItqV6-0002vG-6Z; Sun, 18 Nov 2007 15:12:16 -0500 Received: from TIAGO ([190.30.83.58]:23186 "HELO TIAGO" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by a24407bdkkafe.net with ESMTP id 385E49302521 (ORCPT ); Sun, 18 Nov 2007 18:12:22 -0200 Message-ID: <001201c82a0e$90f36c80$06cc4eac@TIAGO> From: sweet no To: imapext-archive@lists.ietf.org Subject: idual Date: Sun, 18 Nov 2007 18:12:22 -0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000F_01C82A0E.90F36C80" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.3000 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1158 X-Spam-Score: 0.1 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 This is a multi-part message in MIME format. ------=_NextPart_000_000F_01C82A0E.90F36C80 Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable same music played on a particular radio station: our minds simply economic restructuring has been transformed from social and enjoyable and i= nteresting. They might also contribute to a higher ------=_NextPart_000_000F_01C82A0E.90F36C80 Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable

short essays concerning my journey as anew and impressionable

Are you wa< >nting a bi< >gger p_ < >e > n _i= s?

A< >s s< >een on T< >V

Over 725,000 Men arou< >nd the world are already sa< >tisfied
=
Gain 3+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< >= p _t< >o 20%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcis= es!
*F _R< >E >< >E B< >m ot< >tles

communication on the Internet will be very much like regular
------=_NextPart_000_000F_01C82A0E.90F36C80-- From gb@sofitel.ae Mon Nov 19 00:27:40 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ItzAa-00040u-Sy for ipsec-archive@lists.ietf.org; Mon, 19 Nov 2007 00:27:40 -0500 Received: from [122.169.7.236] (helo=ABTS-mum-dynamic-236.7.169.122.airtelbroadband.in) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1ItzAV-000734-NT for ipsec-archive@lists.ietf.org; Mon, 19 Nov 2007 00:27:40 -0500 Received: (qmail 26193 invoked from network); Mon, 19 Nov 2007 10:57:32 +0530 Received: from unknown (HELO utkec) (183.89.27.237) by ABTS-mum-dynamic-236.7.169.122.airtelbroadband.in with SMTP; Mon, 19 Nov 2007 10:57:32 +0530 Message-ID: <47411EC4.4030306@sofitel.ae> Date: Mon, 19 Nov 2007 10:57:32 +0530 From: User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: ipsec-archive@lists.ietf.org Subject: Early Christmas gift Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 3.5 (+++) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Facilities seek shelter from energy crisis provided by E tG U EnerBrite Technologies Group, Inc. E t gU $0.008 5 point you should be on top of 1. Energy problems are a Global issue 2. Governments are yet to provide real relief forcing business to find solutions themselves. 3. EnerBrite's proven system reduces energy costs by as much as 30%. 4. Florida facilities are already using E t g U's new SensorStat to provide relief from their enormous energy bills. 5. e T GU is launching a huge media campaign to increase investor awareness next week. EnerBrite is in the right place at the right time. Providing working solutions to the energy crisis we are facing. This penny stock has the potential to double or even triple early investor's returns. Read up and move on e TG U first thing Monday. From ipsec-bounces@ietf.org Mon Nov 19 02:54:16 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu1Rg-0005iA-ND; Mon, 19 Nov 2007 02:53:28 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iu1Re-0005g8-NA for ipsec-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 02:53:26 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu1RY-0005f9-Qz for ipsec@ietf.org; Mon, 19 Nov 2007 02:53:20 -0500 Received: from smtp.nokia.com ([192.100.105.134] helo=mgw-mx09.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iu1RT-0004Qf-BO for ipsec@ietf.org; Mon, 19 Nov 2007 02:53:20 -0500 Received: from esebh107.NOE.Nokia.com (esebh107.ntc.nokia.com [172.21.143.143]) by mgw-mx09.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id lAJ7qUwK015604; Mon, 19 Nov 2007 01:53:01 -0600 Received: from esebh102.NOE.Nokia.com ([172.21.138.183]) by esebh107.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 19 Nov 2007 09:52:19 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh102.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 19 Nov 2007 09:52:19 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] CHILD_SA and PFS Date: Mon, 19 Nov 2007 09:52:18 +0200 Message-ID: In-Reply-To: <473DC1D4.5070200@certicom.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] CHILD_SA and PFS Thread-Index: Acgoa7mRUXfLIIRpQv6WEvLiyc/+CwCELOMg References: <473DC1D4.5070200@certicom.com> From: To: , X-OriginalArrivalTime: 19 Nov 2007 07:52:19.0129 (UTC) FILETIME=[1C236A90:01C82A81] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org If the initial handshakes have completed, the peers have at least=20 one Diffie-Hellman group they both support and consider acceptable. Although in theory you could consider group X acceptable only for "phase 1", but not "phase 2", this sounds like a somewhat weird policy to me. About the "PFS mode": if the exchange initiator proposes a DH group in CREATE_CHILD_SA exchange, I'd usually expect the=20 responder to accept it (if the group is generally acceptable),=20 even if the responder doesn't care about PFS. If the initiator=20 doesn't propose a DH group, and the responder cares about PFS,=20 the responder can always initiate rekeying itself. Best regards, Pasi > -----Original Message----- > From: ext Chinh Nguyen [mailto:cnguyen@certicom.com]=20 > Sent: 16 November, 2007 18:14 > To: ipsec@ietf.org > Subject: [IPsec] CHILD_SA and PFS >=20 > As stated in RFC4718, we do not include a DH group in the first > CHILD_SA's proposals, due to the fact that no KE payloads are > exchanged. This leaves the situation that any mismatch in the "PFS" > mode of the peers (on/off) or DH group will not be known until the > ipsec SA rekeys. At which time, presumably a NO PROPOSAL CHOSEN > will be sent back. >=20 > However, from a VPN user's perspective, it's not clear which is the > more palatable scenario: failure to login (assuming we send the DH > group in SAi2) or failure to maintain a VPN session (ipsec rekey > fails). >=20 > Chinh > -- > http://www.certicom.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From RaymundoinvincibleFaulkner@suburbanchicagonews.com Mon Nov 19 04:12:15 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu2fv-00013A-1D; Mon, 19 Nov 2007 04:12:15 -0500 Received: from [41.251.28.17] (helo=post1) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iu2fu-0000cy-CH; Mon, 19 Nov 2007 04:12:14 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host80526055.suburbanchicagonews.com (8.13.1/8.13.1) with SMTP id JL1o7gFu53.203349.OcE.avT.1369497962337 for ; Mon, 19 Nov 2007 10:04:35 -0100 Message-ID: <8f8601c82a8b$4fb28760$0202a8c0@post1> From: "Booker Richmond" To: Subject: Approval process Date: Mon, 19 Nov 2007 10:04:35 -0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_8F82_01C82A8B.4FB28760" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.3790.2663 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_8F82_01C82A8B.4FB28760 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_8F82_01C82A8B.4FB28760 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_8F82_01C82A8B.4FB28760-- From ssheehan@swingtonite.com Mon Nov 19 06:49:38 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu58E-000893-5M; Mon, 19 Nov 2007 06:49:38 -0500 Received: from [189.10.89.181] (helo=[189.10.89.181]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iu589-0003bU-3n; Mon, 19 Nov 2007 06:49:37 -0500 Received: from [189.10.89.181] by smtp.secureserver.net; Mon, 19 Nov 2007 09:03:17 -0300 Message-ID: <01c82a8b$062e2f90$b5590abd@ssheehan> From: "Euphrasia Sinclair" To: Subject: Janie's bouffant dick Date: Mon, 19 Nov 2007 09:03:17 -0300 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="windows-1250" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1478 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 X-Spam-Score: 4.6 (++++) X-Scan-Signature: 0f1ff0b0158b41ac6b9548d0972cdd31 beetta . com From WillablanketLacey@meetingtotal.org Mon Nov 19 08:06:49 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu6Kv-0002cG-4R; Mon, 19 Nov 2007 08:06:49 -0500 Received: from 212.183.223.60.dyn.user.ono.com ([212.183.223.60] helo=equipo) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iu6Ks-0005qs-Lj; Mon, 19 Nov 2007 08:06:47 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host52822989.meetingtotal.org (8.13.1/8.13.1) with SMTP id N6cmnT3b41.410075.vQN.w68.1387915982358 for ; Mon, 19 Nov 2007 14:06:05 -0100 Message-ID: From: "Lucile Schmitz" To: Subject: What can we offer you? Date: Mon, 19 Nov 2007 14:06:05 -0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_EAEB_01C82AAD.035637F0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam-Score: 2.3 (++) X-Scan-Signature: f607d15ccc2bc4eaf3ade8ffa8af02a0 This is a multi-part message in MIME format. ------=_NextPart_000_EAEB_01C82AAD.035637F0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Your credit does not matter to us! If your family OWN real estate and want IMMEDIATE pin money to spend ANY = way you like, or simply need to LOWER your entire payment by a third or = more, here is best deal we can offer you TONIGHT (hurry, this lot will = expire THIS EVENING): $302,000+ debt AND EVEN MORE: After further review, our lenders have established the = lowest payments! Hurry, when best deal is gone, it is gone. Simply fill this = user-friendly form... Do not worry about approval, your credit will not disqualify you! http://www.golianti.cn/ ------=_NextPart_000_EAEB_01C82AAD.035637F0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20
Your credit score doesn't = matter to=20 us!
=20
If your family OWN real = estate and=20 want IMMEDIATE pin money to spend ANY way you like, or simply need to = LOWER=20 your current payments by a third or more, here is our deal we can offer = you=20 TODAY (hurry, this deal will expire TODAY):
=20
$413,000+ = debt
AND EVEN MORE: After = further review,=20 our lenders have set the lowest payments!
=20
Hurry, when best deal is = gone, it is=20 gone. Simply complete this plain form...
=20
Do not worry about = approval, your=20 credit score will not disqualify you!
=20
http://www.golianti.cn/
------=_NextPart_000_EAEB_01C82AAD.035637F0-- From ipsec-bounces@ietf.org Mon Nov 19 10:49:32 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu8ry-00085S-GA; Mon, 19 Nov 2007 10:49:06 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iu8rx-00084m-8y for ipsec-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 10:49:05 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iu8rw-00084Z-T3 for ipsec@ietf.org; Mon, 19 Nov 2007 10:49:04 -0500 Received: from mail.ca.certicom.com ([38.113.160.197]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iu8ru-0002vm-8Y for ipsec@ietf.org; Mon, 19 Nov 2007 10:49:04 -0500 Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id D4A3E10027FE4; Mon, 19 Nov 2007 10:48:41 -0500 (EST) Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm.certicom.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2GaI6poiVoGn; Mon, 19 Nov 2007 10:48:39 -0500 (EST) Received: from domino1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP; Mon, 19 Nov 2007 10:48:39 -0500 (EST) Received: from [10.24.0.104] ([10.24.0.104]) by domino1.certicom.com (Lotus Domino Release 7.0.2FP2 HF177) with ESMTP id 2007111910482921-29213 ; Mon, 19 Nov 2007 10:48:29 -0500 Message-ID: <4741B094.306@certicom.com> Date: Mon, 19 Nov 2007 10:49:40 -0500 From: Chinh Nguyen User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: Pasi.Eronen@nokia.com Subject: Re: [IPsec] CHILD_SA and PFS References: <473DC1D4.5070200@certicom.com> In-Reply-To: X-MIMETrack: Itemize by SMTP Server on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/19/2007 10:48:29 AM, Serialize by Router on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/19/2007 10:48:30 AM, Serialize complete at 11/19/2007 10:48:30 AM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Spam-Score: -0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Pasi.Eronen@nokia.com wrote: > If the initial handshakes have completed, the peers have at least > one Diffie-Hellman group they both support and consider acceptable. > Although in theory you could consider group X acceptable only > for "phase 1", but not "phase 2", this sounds like a somewhat > weird policy to me. Users of Certicom's IPSec can specify different DH groups for IKE and IPsec. Of couse, this is our implementation choice and I don't want to generalize to other implementation. > > About the "PFS mode": if the exchange initiator proposes a DH > group in CREATE_CHILD_SA exchange, I'd usually expect the > responder to accept it (if the group is generally acceptable), > even if the responder doesn't care about PFS. If the initiator Unfortunately, since we do not associate/share any phase 1 settings with phase 2 settings, if the configured ipsec proposals contain no DH group, there's just no way to accept the ipsec rekey. > doesn't propose a DH group, and the responder cares about PFS, > the responder can always initiate rekeying itself. I would suspect that the peer, unable to rekey itself, has torn down the connection by the time the responder decides to rekey. The logic that "if peer rekeys without PFS and PFS is needed then we rekey right away" is currently too specialized for us to consider adding at this time. So my query is this. There is a statement in the RFC that since there is no KE payload (and nonces) in the IKE_AUTH, this implies that the DH group should be NONE or omitted. I don't understand logically why the latter follows from the former. I thought an SA proposal is to enumerate supported/acceptable transforms (and one possible usage is the inclusion of a DH group in the CHILD_SA SA proposals to signal PFS in rekey). Chinh -- http://www.certicom.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From malo@TABInc.org Mon Nov 19 12:53:41 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuAoX-0003hO-Ez for ipsec-archive@lists.ietf.org; Mon, 19 Nov 2007 12:53:41 -0500 Received: from host-84-223-130-114.cust-adsl.tiscali.it ([84.223.130.114] helo=host-84-223-131-28.cust-adsl.tiscali.it) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuAoW-0005lW-Nl for ipsec-archive@lists.ietf.org; Mon, 19 Nov 2007 12:53:41 -0500 Received: from standard-022456 ([191.180.64.166]:30806 "EHLO standard-022456" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by host-84-223-131-28.cust-adsl.tiscali.it with ESMTP id S22UUNZSEROLIFHG (ORCPT ); Mon, 19 Nov 2007 18:53:53 +0100 Message-ID: <000d01c82ad5$1e3a3170$1c83df54@standard022456> From: "malo medisan" To: Subject: onbuizen Date: Mon, 19 Nov 2007 18:53:40 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0005_01C82ADD.7FFE9970" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 3.5 (+++) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 ------=_NextPart_000_0005_01C82ADD.7FFE9970 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable A good way to make good life even better sw Natisov http://radiohundred.com/ ------=_NextPart_000_0005_01C82ADD.7FFE9970 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
A good way to make good life even = better
sw Natisov
http://radiohundred.com/ ------=_NextPart_000_0005_01C82ADD.7FFE9970-- From ipsec-bounces@ietf.org Mon Nov 19 14:03:58 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuBuM-0001HW-BS; Mon, 19 Nov 2007 14:03:46 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuAxy-0002w5-J1 for ipsec-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 13:03:26 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuAxy-0002vg-7Y for ipsec@ietf.org; Mon, 19 Nov 2007 13:03:26 -0500 Received: from zcars04f.nortel.com ([47.129.242.57]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuAxx-0006ZE-PD for ipsec@ietf.org; Mon, 19 Nov 2007 13:03:26 -0500 Received: from zrc2hxm1.corp.nortel.com (zrc2hxm1.corp.nortel.com [47.103.123.72]) by zcars04f.nortel.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id lAJI3Mp16693; Mon, 19 Nov 2007 18:03:22 GMT X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] CHILD_SA and PFS Date: Mon, 19 Nov 2007 12:03:16 -0600 Message-ID: <57852B615814704D91EC988F6EA9DF2203B3332F@zrc2hxm1.corp.nortel.com> In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] CHILD_SA and PFS Thread-Index: Acgoa7mRUXfLIIRpQv6WEvLiyc/+CwCELOMgABYaRMA= References: <473DC1D4.5070200@certicom.com> From: "Ricky Charlet" To: , , X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a X-Mailman-Approved-At: Mon, 19 Nov 2007 14:03:45 -0500 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Hi Pasi, =20 Does this still leave a true IKEv2 protocol problem for environments which wish to configure separate DH groups for IKE and IPsec SAs and also have reasons (NAT / remote-access) to configure the peers as initiator/responder only? If the answer is "if you need to configure initiator/responder only then you have to adminstrativly ensure that your PFS policy uses the same DH group for both IKE and=20 IPsec" that would be fine (with me). I'm just not yet clear if that is what you are saying. My basic question is... Do I have to write documentation guidance to adminstrators of my systems for this? =20 Ricky Charlet rcharlet@nortel.com > -----Original Message----- > From: Pasi.Eronen@nokia.com [mailto:Pasi.Eronen@nokia.com]=20 > Sent: Sunday, November 18, 2007 11:52 PM > To: cnguyen@certicom.com; ipsec@ietf.org > Subject: RE: [IPsec] CHILD_SA and PFS >=20 >=20 > If the initial handshakes have completed, the peers have at least=20 > one Diffie-Hellman group they both support and consider acceptable. > Although in theory you could consider group X acceptable only > for "phase 1", but not "phase 2", this sounds like a somewhat > weird policy to me. >=20 > About the "PFS mode": if the exchange initiator proposes a DH > group in CREATE_CHILD_SA exchange, I'd usually expect the=20 > responder to accept it (if the group is generally acceptable),=20 > even if the responder doesn't care about PFS. If the initiator=20 > doesn't propose a DH group, and the responder cares about PFS,=20 > the responder can always initiate rekeying itself. >=20 > Best regards, > Pasi >=20 > > -----Original Message----- > > From: ext Chinh Nguyen [mailto:cnguyen@certicom.com]=20 > > Sent: 16 November, 2007 18:14 > > To: ipsec@ietf.org > > Subject: [IPsec] CHILD_SA and PFS > >=20 > > As stated in RFC4718, we do not include a DH group in the first > > CHILD_SA's proposals, due to the fact that no KE payloads are > > exchanged. This leaves the situation that any mismatch in the "PFS" > > mode of the peers (on/off) or DH group will not be known until the > > ipsec SA rekeys. At which time, presumably a NO PROPOSAL CHOSEN > > will be sent back. > >=20 > > However, from a VPN user's perspective, it's not clear which is the > > more palatable scenario: failure to login (assuming we send the DH > > group in SAi2) or failure to maintain a VPN session (ipsec rekey > > fails). >=20 > >=20 > > Chinh > > -- > > http://www.certicom.com >=20 >=20 > _______________________________________________ > IPsec mailing list > IPsec@ietf.org > https://www1.ietf.org/mailman/listinfo/ipsec >=20 _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From rfremoval@yourfit.com Mon Nov 19 14:49:49 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuCcv-0006kR-SP; Mon, 19 Nov 2007 14:49:49 -0500 Received: from host-89-229-14-196.torun.mm.pl ([89.229.14.196] helo=vild-comp.torun.mm.pl) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IuCcr-0007LJ-Nb; Mon, 19 Nov 2007 14:49:47 -0500 Received: from vildcomp ([68.58.156.152]:1629 "HELO vildcomp" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by c40ee559yourfit.com with ESMTP id 740B115C1A93 (ORCPT ); Mon, 19 Nov 2007 20:49:42 +0100 Message-ID: <001001c82aed$b58531c0$061bd464@vildcomp> From: greenhouse To: imapext-archive@lists.ietf.org Subject: on know Date: Mon, 19 Nov 2007 20:49:42 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000D_01C82AED.B58531C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.181 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.1081 X-Spam-Score: 0.1 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 This is a multi-part message in MIME format. ------=_NextPart_000_000D_01C82AED.B58531C0 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable that. But since that`s what i`m doing anyways, heck, why not? I analysis. By transferring cumbersome photographic archives of might be per= ceived as healthy. I sometimes envision a situation ------=_NextPart_000_000D_01C82AED.B58531C0 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable

of desired clothing. Then, ones appearance will be viewed in a

Are you wa< >nting a bi< >gger p_ < >e > n _is? =

A< >s s< >een on T< >V

Over 786,000 Men arou< >nd the world are already sa< >tisfied
=
Gain 2+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< = >p _t< >o 29%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcises!=
*F _R< >E >< >E B< >m ot< >tles

excluded from many potential interesting environments if they do
= ------=_NextPart_000_000D_01C82AED.B58531C0-- From mkmbasket@burrell.com Mon Nov 19 14:51:08 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuCeB-0006gD-Vx; Mon, 19 Nov 2007 14:51:08 -0500 Received: from 123-240-30-68.cctv.dynamic.lsc.net.tw ([123.240.30.68] helo=user-oa98ryb6pe.in.cctv.lsc.net.tw) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IuCe9-0007Pe-5E; Mon, 19 Nov 2007 14:51:05 -0500 Received: from useroa98ryb6pe ([186.184.63.215]:46901 "HELO useroa98ryb6pe" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by 441ef07bburrell.com with ESMTP id 59503F3537C1A3 (ORCPT ); Tue, 20 Nov 2007 03:51:51 +0800 Message-ID: <001401c82b28$aef09df0$01c0cea4@useroa98ryb6pe> From: Janine To: imapext-archive@lists.ietf.org Subject: Be civil Date: Tue, 20 Nov 2007 03:51:51 +0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0011_01C82B28.AEF09DF0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.2969 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2600.4682 X-Spam-Score: 1.7 (+) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 This is a multi-part message in MIME format. ------=_NextPart_000_0011_01C82B28.AEF09DF0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable however, in the age where full-blown cyberculture is not far off of writing, I am eager to tap the dynamics of the realm of architecture. I = have recently experimented with the AutoCad ------=_NextPart_000_0011_01C82B28.AEF09DF0 Content-Type: text/html; charset="windows-1251" Content-Transfer-Encoding: quoted-printable

disastrous. Even a general recognmition by society to admit and

Are you wa< >nting a bi< >gger p_ < >e > = n _is?

A< >s s< >een on T< >V

Over 732,000 Men arou< >nd the world are already sa< >tisfied
Gain 3+ Inches In Leng _th
Increase Your P _< >en -i< >s Wi< > _dth (Gir< >th) By u< = >p _t< >o 23%
100% Sa< >fe To Ta< >ke, With NO Side Effe< >cts
N< >o Pu< >m _ps! N< >o Surg< >ery! N< >o Exe< >rcises! <= /DIV>
*F _R< >E >< >E B< >m ot< >tles

solve problems and create theories that will undoubtedly keep
------=_NextPart_000_0011_01C82B28.AEF09DF0-- From ipsec-bounces@ietf.org Mon Nov 19 18:24:14 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuFyE-0002OO-IN; Mon, 19 Nov 2007 18:24:02 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuFyC-0002LM-Uy for ipsec-confirm+ok@megatron.ietf.org; Mon, 19 Nov 2007 18:24:00 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuFyC-0002L3-25; Mon, 19 Nov 2007 18:24:00 -0500 Received: from balder-227.proper.com ([192.245.12.227]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuFyB-00071Z-Iy; Mon, 19 Nov 2007 18:23:59 -0500 Received: from [10.20.30.108] (dsl-63-249-108-169.cruzio.com [63.249.108.169]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id lAJNNvKc033798 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 19 Nov 2007 16:23:58 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: Date: Mon, 19 Nov 2007 15:23:13 -0800 To: ipsec@ietf.org, ietf-smime@imc.org, tls@ietf.org From: Paul Hoffman Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Cc: Subject: [IPsec] Fwd: Document Action: 'Additional Diffie-Hellman Groups for use with IETF Standards' to Informational RFC X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org >The IESG has approved the following document: > >- 'Additional Diffie-Hellman Groups for use with IETF Standards ' > as an Informational RFC > >This document has been reviewed in the IETF but is not the product of an >IETF Working Group. > >The IESG contact person is Tim Polk. > >A URL of this Internet-Draft is: >http://www.ietf.org/internet-drafts/draft-lepinski-dh-groups-03.txt > >Technical Summary > >This document specifies (eight) Diffie-Hellman groups for use with >security protocols developed by five different IETF WGs (IPsec, PKIX, >S/MIME, SSH, SSL, and TLS). The specified groups include three >modular exponentiation groups and five elliptic curve groups. Several >of the Diffie-Hellman groups specified in this draft are already >defined in WG-specific RFCs (e.g., RFC 3526 and RFC 4753) and I-Ds, >but without the test data provided here. The group definitions and >test data are derived from a NIST document that is available only >on the NIST web site as a PDF. This draft translates the parameter >terminology from the with NIST document into a form consistent with >RFCs that define Diffie-Hellman groups (in protocol-specific contexts), >and removes extraneous test data that would not be relevant to IETF >protocols. > >Working Group Summary > >This document was not the product of any working group, but has been >reviewed by experts from several relevant wgs. Specifically, this >document >incorporates comments from: Tero Kivinen, the designated >approver of additional Diffie-Hellman groups for IKE; Sean >Turner S/MIME WG co-chair; and Pasi Eronen (TLS WG co-chair). Steve >Kent (PKIX co-chair) is a co-author of this document and he ensured >that PKIX concerns were addressed. No input was solicited form the >SSH WG co-chairs, as that protocol provides a trivial means of >accommodating additional (mod p) Diffie-Hellman groups. SSH provides >no means of accommodating Elliptic Curve Diffie-Hellman groups, and >as a result, the document is silent on use of Elliptic Curve >Diffie-Hellman groups with SSH. (There is an expired I-D that >describes how to use Elliptic Curve Diffie-Hellman with SSH. If it >is re-submitted and adopted by the SSH WG, it would be appropriate >to amend this draft to include it as well.) > >Protocol Quality > >Tim Polk reviewed this specification for the IESG. Larry Bassham, who >drafted the base NIST document, has also reviewed the specification. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 05:16:36 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuQ9R-0000Ew-MT; Tue, 20 Nov 2007 05:16:17 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuQ9R-0000Er-8d for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 05:16:17 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuQ9Q-0000D6-U1 for ipsec@ietf.org; Tue, 20 Nov 2007 05:16:16 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IuQ9N-0005Mv-45 for ipsec@ietf.org; Tue, 20 Nov 2007 05:16:16 -0500 Received: from MBP.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lAKAG8WN008199; Tue, 20 Nov 2007 12:16:08 +0200 (IST) Message-Id: <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> From: Yoav Nir To: Chinh Nguyen , ipsec@ietf.org In-Reply-To: <4741B094.306@certicom.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [IPsec] CHILD_SA and PFS Date: Tue, 20 Nov 2007 12:16:06 +0200 References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: f60d0f7806b0c40781eee6b9cd0b2135 Cc: Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org I believe that your suggestion in the last line is a very good one. However, RFC 4306 says this: In the CHILD_SA created as part of the initial exchange, a second KE payload and nonce MUST NOT be sent. The nonces from the initial exchange are used in computing the keys for the CHILD_SA. and also this If the SA offers include different Diffie-Hellman groups, KEi MUST be an element of the group the initiator expects the responder to accept. If it guesses wrong, Taken together, this says that if you include a D-H transform, you also need to include a KE payload, and in AUTH that's not allowed, so the D-H transform is not allowed either. I agree that this is a real problem not just because a peer may be configured to do group #5 for IKE and group #2 for IPsec, but because some IKE peers may prohibit D-H for IPsec (for example RA concentrators) while others may require it. This is clearly a mismatched configuration, yet it will only be discovered when the IPsec SA needs to be rekeyed. So I think your idea is a good one, but it is in conflict with RFC 4306. I can think of two ways to fix this: 1. Add a notification to IKEv2 with a name like WILL_DO_PFS_ON_REKEY that can be added to the AUTH exchange. It will specify the groups supported (maybe only zero for no PFS). A peer that recognizes this notification may fail the exchange if the next CHILD_SA is doomed to fail. 2. Implement your suggestions, but this is a bits-on-the-wire change, and will probably force us to call this IKEv2.1. If you want to go that path, there's probably lots of others who would like to get things into v2.1, so that would be a long haul indeed. Yoav On Nov 19, 2007, at 5:49 PM, Chinh Nguyen wrote: > >> doesn't propose a DH group, and the responder cares about PFS, the >> responder can always initiate rekeying itself. > > I would suspect that the peer, unable to rekey itself, has torn down > the connection by the time the responder decides to rekey. > > The logic that "if peer rekeys without PFS and PFS is needed then we > rekey right away" is currently too specialized for us to consider > adding at this time. > > So my query is this. There is a statement in the RFC that since > there is no KE payload (and nonces) in the IKE_AUTH, this implies > that the DH group should be NONE or omitted. I don't understand > logically why the latter follows from the former. > > I thought an SA proposal is to enumerate supported/acceptable > transforms (and one possible usage is the inclusion of a DH group in > the CHILD_SA SA proposals to signal PFS in rekey). > > Chinh > -- > http://www.certicom.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 06:08:13 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuQxg-0003BA-0S; Tue, 20 Nov 2007 06:08:12 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuQxe-0003B4-UZ for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 06:08:10 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuQxe-0003At-EA for ipsec@ietf.org; Tue, 20 Nov 2007 06:08:10 -0500 Received: from smtp.nokia.com ([192.100.105.134] helo=mgw-mx09.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IuQxb-0006aC-8I for ipsec@ietf.org; Tue, 20 Nov 2007 06:08:10 -0500 Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-mx09.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id lAKB614O028708; Tue, 20 Nov 2007 05:08:04 -0600 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 20 Nov 2007 13:07:39 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 20 Nov 2007 13:07:39 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] CHILD_SA and PFS Date: Tue, 20 Nov 2007 13:07:39 +0200 Message-ID: In-Reply-To: <57852B615814704D91EC988F6EA9DF2203B3332F@zrc2hxm1.corp.nortel.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] CHILD_SA and PFS Thread-Index: Acgoa7mRUXfLIIRpQv6WEvLiyc/+CwCELOMgABYaRMAAI91i0A== References: <473DC1D4.5070200@certicom.com> <57852B615814704D91EC988F6EA9DF2203B3332F@zrc2hxm1.corp.nortel.com> From: To: , , X-OriginalArrivalTime: 20 Nov 2007 11:07:39.0856 (UTC) FILETIME=[90A62D00:01C82B65] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Ricky Charlet wrote: > Hi Pasi, > =20 > Does this still leave a true IKEv2 protocol problem for environments > which wish to configure separate DH groups for IKE and IPsec SAs and > also have reasons (NAT / remote-access) to configure the peers as > initiator/responder only? >=20 > If the answer is "if you need to configure initiator/responder > only then you have to adminstrativly ensure that your PFS policy > uses the same DH group for both IKE and IPsec" that would be fine > (with me). I'm just not yet clear if that is what you are saying. Well, the answer is that "if you want to do PFS, you need to=20 configure the initiator and the responder so that they have at=20 least one acceptable DH group in common". This is the case even with the protocol changes Chinh is proposing. The difference is only at what time the policy mismatch is detected and the connection is torn down (until the administrator changes the configuration). Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 06:08:21 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuQxp-0003GI-Ej; Tue, 20 Nov 2007 06:08:21 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuQxn-0003E7-V9 for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 06:08:19 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuQxn-0003Dz-Jn for ipsec@ietf.org; Tue, 20 Nov 2007 06:08:19 -0500 Received: from smtp.nokia.com ([131.228.20.172] helo=mgw-ext13.nokia.com) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuQxn-0006sE-4K for ipsec@ietf.org; Tue, 20 Nov 2007 06:08:19 -0500 Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-ext13.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lAKB7W15008930; Tue, 20 Nov 2007 13:08:09 +0200 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 20 Nov 2007 13:07:39 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 20 Nov 2007 13:07:39 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] CHILD_SA and PFS Date: Tue, 20 Nov 2007 13:07:39 +0200 Message-ID: In-Reply-To: <4741B094.306@certicom.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] CHILD_SA and PFS Thread-Index: Acgqw7/vl/NguD5EQbi0mkDmlNtc5QAoClPQ References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> From: To: X-OriginalArrivalTime: 20 Nov 2007 11:07:39.0528 (UTC) FILETIME=[90742080:01C82B65] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Chinh Nguyen wrote: > So my query is this. There is a statement in the RFC that since > there is no KE payload (and nonces) in the IKE_AUTH, this implies > that the DH group should be NONE or omitted. I don't understand > logically why the latter follows from the former. >=20 > I thought an SA proposal is to enumerate supported/acceptable > transforms (and one possible usage is the inclusion of a DH group > in the CHILD_SA SA proposals to signal PFS in rekey). The SA proposal here enumerates the transforms to be used for *this* CHILD_SA creation (not future CHILD_SAs; those exchanges have their own SA payloads, which may contain different things). Since no Diffie-Hellman calculation is done when this CHILD_SA is created, you can't get negotiate the Diffie-Hellman transform here. Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 06:13:54 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuR35-0006nj-6Y; Tue, 20 Nov 2007 06:13:47 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuR33-0006in-Fv for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 06:13:45 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuR33-0006if-6U for ipsec@ietf.org; Tue, 20 Nov 2007 06:13:45 -0500 Received: from smtp.nokia.com ([192.100.122.233] helo=mgw-mx06.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IuR30-0006jz-BM for ipsec@ietf.org; Tue, 20 Nov 2007 06:13:45 -0500 Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-mx06.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id lAKBCfAY013947; Tue, 20 Nov 2007 13:13:06 +0200 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 20 Nov 2007 13:12:31 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 20 Nov 2007 13:12:31 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] CHILD_SA and PFS Date: Tue, 20 Nov 2007 13:12:30 +0200 Message-ID: In-Reply-To: <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] CHILD_SA and PFS Thread-Index: AcgrXmvBHnxdRtMESLa++qxYH5snngABl+rQ References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> From: To: , X-OriginalArrivalTime: 20 Nov 2007 11:12:31.0122 (UTC) FILETIME=[3E41D720:01C82B66] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Yoav Nir wrote: > I agree that this is a real problem not just because a peer may > be configured to do group #5 for IKE and group #2 for IPsec, but > because some IKE peers may prohibit D-H for IPsec (for example RA > concentrators) while others may require it. This is clearly a > mismatched configuration, yet it will only be discovered when the > IPsec SA needs to be rekeyed. > > So I think your idea is a good one, but it is in conflict=20 > with RFC 4306. >=20 > I can think of two ways to fix this: >=20 > 1. Add a notification to IKEv2 with a name like > WILL_DO_PFS_ON_REKEY that can be added to the AUTH exchange. It > will specify the groups supported (maybe only zero for no PFS). A > peer that recognizes this notification may fail the exchange if > the next CHILD_SA is doomed to fail. In general, there's no way to know whether a CREATE_CHILD_SA exchange will succeed without trying it. The DH group seems to be rather small part of this: one peer could require using AES-256 for some traffic, but the other one could require something else.=20 If the policies are fundamentally incompatible (and changing them requires administrative action), I'm not sure if it's important to discover *this* particular incompatibility during IKE_SA creation (since most of the incompatibilities can't be discovered anyway at this time). BTW, the chances of having mismatched policy probably depend on the user interface. If the UI offers exclusive options "(A) No PFS, (B) Group 2, (C) Group 5", it's easy to configure mismatched policies. If the interface offered options "(1) Propose PFS with groups 2,5,X,Y (2) Require PFS with groups 2,5,X,Y -- fail connection if not supported by peer, (3) Don't propose PFS but accept if required by peer, (4) Prohibit PFS -- fail connection=20 if required by peer", probably fewer people would choose "4" than would choose "A". (This is of course only a hypothesis, not confirmed by testing.) Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 08:21:58 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuT2U-00088H-8p; Tue, 20 Nov 2007 08:21:18 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuT2S-000831-Q4 for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 08:21:16 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuT2S-00080d-FF for ipsec@ietf.org; Tue, 20 Nov 2007 08:21:16 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IuT2S-0001iR-1i for ipsec@ietf.org; Tue, 20 Nov 2007 08:21:16 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lAKDKp8R018674 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 20 Nov 2007 15:20:51 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lAKDKkOO025190; Tue, 20 Nov 2007 15:20:46 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18242.57134.201314.799049@fireball.kivinen.iki.fi> Date: Tue, 20 Nov 2007 15:20:46 +0200 From: Tero Kivinen To: Yoav Nir Subject: Re: [IPsec] CHILD_SA and PFS In-Reply-To: <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 7 min X-Total-Time: 11 min X-Spam-Score: -1.4 (-) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Cc: ipsec@ietf.org, Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Yoav Nir writes: > I can think of two ways to fix this: I think the easiest is to fix the configuration. Note that this does not cause any big problem even if nothing is done. The IPsec SA rekey will fail, which means the IPsec SA will expire, and when creating new IPsec SA fails too, the initiator will tear down the IKE SA, and recreate it, which will again generate new IKE SA and IPsec SA and traffic works again. I.e every few hours there is few seconds when traffic does not work because of configuration error. If the user wants to get rid of it he should fix the confuration. -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 08:52:21 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuTWT-0001hM-Hm; Tue, 20 Nov 2007 08:52:17 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuTWS-0001hH-0W for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 08:52:16 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuTWR-0001h8-N4 for ipsec@ietf.org; Tue, 20 Nov 2007 08:52:15 -0500 Received: from mail.ca.certicom.com ([38.113.160.197]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IuTWM-0002Y8-MZ for ipsec@ietf.org; Tue, 20 Nov 2007 08:52:15 -0500 Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id 5401210027FE3; Tue, 20 Nov 2007 08:51:50 -0500 (EST) Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm.certicom.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n9Pv9h0cHOIl; Tue, 20 Nov 2007 08:51:42 -0500 (EST) Received: from domino1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP; Tue, 20 Nov 2007 08:51:42 -0500 (EST) Received: from [10.24.0.104] ([10.24.0.104]) by domino1.certicom.com (Lotus Domino Release 7.0.2FP2 HF177) with ESMTP id 2007112008513322-33000 ; Tue, 20 Nov 2007 08:51:33 -0500 Message-ID: <4742E6AD.7050602@certicom.com> Date: Tue, 20 Nov 2007 08:52:45 -0500 From: Chinh Nguyen User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: Pasi.Eronen@nokia.com Subject: Re: [IPsec] CHILD_SA and PFS References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> In-Reply-To: X-MIMETrack: Itemize by SMTP Server on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/20/2007 08:51:33 AM, Serialize by Router on Certicom1/Certicom(Release 7.0.2FP2 HF177|August 10, 2007) at 11/20/2007 08:51:34 AM, Serialize complete at 11/20/2007 08:51:34 AM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Spam-Score: -0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Pasi.Eronen@nokia.com wrote: > The SA proposal here enumerates the transforms to be used for > *this* CHILD_SA creation (not future CHILD_SAs; those exchanges > have their own SA payloads, which may contain different things). > Since no Diffie-Hellman calculation is done when this CHILD_SA is > created, you can't get negotiate the Diffie-Hellman transform here. Yes, of course. This is the clearest, most succinct reason why DH group cannot be included. Thanks, Pasi. Although practically speaking, I don't think I've seen a configuration/implementation that changes its SA proposal (DH group for PFS excepted) upon rekey. Regards, Chinh -- http://www.certicom.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 20 08:53:57 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuTXy-0003SP-0M; Tue, 20 Nov 2007 08:53:50 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IuTXw-0003FW-F3 for ipsec-confirm+ok@megatron.ietf.org; Tue, 20 Nov 2007 08:53:48 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuTXw-0003CZ-1q for ipsec@ietf.org; Tue, 20 Nov 2007 08:53:48 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IuTXo-0002bk-Qe for ipsec@ietf.org; Tue, 20 Nov 2007 08:53:48 -0500 Received: from MBP.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lAKDrUWN022305; Tue, 20 Nov 2007 15:53:30 +0200 (IST) Message-Id: <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> From: Yoav Nir To: Tero Kivinen , ipsec@ietf.org In-Reply-To: <18242.57134.201314.799049@fireball.kivinen.iki.fi> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [IPsec] CHILD_SA and PFS Date: Tue, 20 Nov 2007 15:53:27 +0200 References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> <18242.57134.201314.799049@fireball.kivinen.iki.fi> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Cc: Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org This assumes that generating a new IKE SA is a painless procedure. For clients, this could mean keying in a passcode from a token, or entering a password or pushing some button on a phone. Even if generating an IKE SA is painless, it's also bad if you need multiple SAs. Only the first SA (the one that happened to trigger IKE) will succeed. All the others will fail (assuming all require PFS). So we have a badly mismatched configuration that occasionally works. On Nov 20, 2007, at 3:20 PM, Tero Kivinen wrote: > Yoav Nir writes: >> I can think of two ways to fix this: > > I think the easiest is to fix the configuration. Note that this does > not cause any big problem even if nothing is done. The IPsec SA rekey > will fail, which means the IPsec SA will expire, and when creating new > IPsec SA fails too, the initiator will tear down the IKE SA, and > recreate it, which will again generate new IKE SA and IPsec SA and > traffic works again. I.e every few hours there is few seconds when > traffic does not work because of configuration error. If the user > wants to get rid of it he should fix the confuration. > -- > kivinen@safenet-inc.com > _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Faisel@123delta.nl Tue Nov 20 14:26:10 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IuYja-0003CE-B5 for ipsec-archive@lists.ietf.org; Tue, 20 Nov 2007 14:26:10 -0500 Received: from if02t2-89-83-140-180.d4.club-internet.fr ([89.83.140.180]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IuYjZ-0007Pk-Gx for ipsec-archive@lists.ietf.org; Tue, 20 Nov 2007 14:26:09 -0500 Received: by 10.32.194.40 with SMTP id rcUWNivxnljdR; Tue, 20 Nov 2007 20:26:17 +0100 (GMT) Received: by 192.168.37.111 with SMTP id TzkBbUShvKAcVk.8526402380476; Tue, 20 Nov 2007 20:26:15 +0100 (GMT) Message-ID: <000c01c82bab$36434780$b48c5359@ChouchN> From: "Faisel fairley" To: Subject: assarcne Date: Tue, 20 Nov 2007 20:26:12 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0009_01C82BB3.9807AF80" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 3.5 (+++) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 ------=_NextPart_000_0009_01C82BB3.9807AF80 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Impress her as your rod gets harder and longer qiao Kausler http://airwritten.com/ ------=_NextPart_000_0009_01C82BB3.9807AF80 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Impress her as your rod gets harder = and longer
qiao Kausler
http://airwritten.com/
------=_NextPart_000_0009_01C82BB3.9807AF80-- From pmnshell@lacordee.com Tue Nov 20 18:32:03 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IucZX-0006bA-Sa; Tue, 20 Nov 2007 18:32:03 -0500 Received: from 201-75-131-6-sa.cpe.vivax.com.br ([201.75.131.6] helo=julio-197189868.vivax.com.br) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IucZX-0001q2-3z; Tue, 20 Nov 2007 18:32:03 -0500 Received: from julio197189868 [210.2.120.187] (port=35268 helo=julio197189868) by 6834bc9lacordee.com with ESMTP id 1639B787901A65 for ; Wed, 21 Nov 2007 21:26:29 -0200 Message-ID: <001801c82c85$2dd70d40$06c06214@julio197189868> From: divers To: imapext-archive@lists.ietf.org Subject: Or my location Date: Wed, 21 Nov 2007 21:26:29 -0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0015_01C82C85.2DD70D40" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.2962 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2462.1409 X-Spam-Score: 3.4 (+++) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 This is a multi-part message in MIME format. ------=_NextPart_000_0015_01C82C85.2DD70D40 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable interaction and the dialouge with other users and the archutects able to remain in one central location and complete all daily Art has generally catered to the passive viewer. Although modern ------=_NextPart_000_0015_01C82C85.2DD70D40 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

future expression of ideas will require a layered, multi-modal

Are you wanting a bi/gg er pe \nis?

As seen on TV

Ov \er 772,000 Men aro /und the world are already sat \isfied
Gain 4+ Inc /hes In Len /gth
Inc \rease Your Pe /nis Wid /th (Gir \th) By u/p-to 22%
100% Safe To Take, With NO Side Effe /cts
No Pumps! No Surgery! No Exercises!

when ever I write it is not about things which are as of yet
------=_NextPart_000_0015_01C82C85.2DD70D40-- From GayletorontoStover@orgonics.com Tue Nov 20 18:36:10 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IucdW-0002EQ-1n; Tue, 20 Nov 2007 18:36:10 -0500 Received: from 201.143.56.166.dsl.dyn.telnor.net ([201.143.56.166] helo=creditocristy.domain.invalid) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IucdT-0001yj-71; Tue, 20 Nov 2007 18:36:09 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host46163516.orgonics.com (8.13.1/8.13.1) with SMTP id yE08VCOA75.963151.CDQ.5bB.2992999904508 for ; Tue, 20 Nov 2007 15:35:26 +0800 Message-ID: <5155701c82bce$22d9b710$06fea8c0@CREDITOCRISTY> From: "Marianne Abrams" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_51553_01C82BCE.22D9B710-- From mattijsDEPRIEST@dgprinting.com Tue Nov 20 19:33:43 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IudXC-0005Tj-Vg for ipsec-archive@lists.ietf.org; Tue, 20 Nov 2007 19:33:43 -0500 Received: from c-71-195-137-211.hsd1.ma.comcast.net ([71.195.137.211]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IudXC-0003qm-GL for ipsec-archive@lists.ietf.org; Tue, 20 Nov 2007 19:33:42 -0500 Received: from smith-x3galc6ge ([126.150.93.100] helo=smith-x3galc6ge) by c-71-195-137-211.hsd1.ma.comcast.net ( sendmail 8.13.3/8.13.1) with esmtpa id 1VEYZj-000OTV-xa for ipsec-archive@lists.ietf.org; Tue, 20 Nov 2007 18:33:56 -0600 Message-ID: <000301c82bd6$2a3d3830$d389c347@smithx3galc6ge> From: "mattijs DEPRIEST" To: Subject: ukodias Date: Tue, 20 Nov 2007 18:33:41 -0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0008_01C82BA3.DFA2C830" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 3.5 (+++) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 ------=_NextPart_000_0008_01C82BA3.DFA2C830 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Make your tiny lace a true symbol of your power Mart Papa http://www.boxfriend.com/ ------=_NextPart_000_0008_01C82BA3.DFA2C830 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Make your tiny lace a true symbol = of your power
Mart Papa
http://www.boxfriend.com/
------=_NextPart_000_0008_01C82BA3.DFA2C830-- From ipsec-bounces@ietf.org Wed Nov 21 10:57:20 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IurwO-0007hc-BR; Wed, 21 Nov 2007 10:56:40 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IurwM-0007X6-6P for ipsec-confirm+ok@megatron.ietf.org; Wed, 21 Nov 2007 10:56:38 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IurwL-0007Vz-Qr for ipsec@ietf.org; Wed, 21 Nov 2007 10:56:37 -0500 Received: from fireball.acr.fi ([83.145.195.1] helo=mail.kivinen.iki.fi) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IurwL-0005QY-9W for ipsec@ietf.org; Wed, 21 Nov 2007 10:56:37 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lALFuBkx028776 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 21 Nov 2007 17:56:16 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lALFu4Oc029126; Wed, 21 Nov 2007 17:56:04 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18244.21780.433641.330743@fireball.kivinen.iki.fi> Date: Wed, 21 Nov 2007 17:56:04 +0200 From: Tero Kivinen To: Yoav Nir Subject: Re: [IPsec] CHILD_SA and PFS In-Reply-To: <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> <18242.57134.201314.799049@fireball.kivinen.iki.fi> <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 4 min X-Total-Time: 3 min X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Cc: ipsec@ietf.org, Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Yoav Nir writes: > This assumes that generating a new IKE SA is a painless procedure. For > clients, this could mean keying in a passcode from a token, or > entering a password or pushing some button on a phone. Which will cause the client to fix the problem sooner than later, which is even better. > Even if generating an IKE SA is painless, it's also bad if you need > multiple SAs. Only the first SA (the one that happened to trigger IKE) > will succeed. All the others will fail (assuming all require PFS). So > we have a badly mismatched configuration that occasionally works. If the policies are different, any of the later SAs can fail too, regardless of PFS. I do not really see that big difference in PFS. In normal case the client should not really care what is configured for the PFS group, it should be configured to: suggest without PFS, allow also any group supported. Then the server can request what kind of policy it wants. -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From IgnaciodwarvesMclaughlin@economist.com Wed Nov 21 20:03:02 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iv0T8-0003OT-Fy; Wed, 21 Nov 2007 20:03:02 -0500 Received: from [190.80.221.217] (helo=verenicebeltran) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iv0T7-00040b-Ja; Wed, 21 Nov 2007 20:03:02 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host13904916.economist.com (8.13.1/8.13.1) with SMTP id 7tjFYBBj91.903633.l2A.nkN.3627750332196 for ; Wed, 21 Nov 2007 21:02:38 +0400 Message-ID: <1ad0c01c82ca3$6f2cd680$0500000a@VereniceBeltran> From: "Dallas Alvarado" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_1AD08_01C82CA3.6F2CD680-- From ipsec-bounces@ietf.org Thu Nov 22 04:32:01 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iv8PT-0007vo-4X; Thu, 22 Nov 2007 04:31:47 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iv8PQ-0007vE-Ve for ipsec-confirm+ok@megatron.ietf.org; Thu, 22 Nov 2007 04:31:44 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iv8PP-0007uJ-5f for ipsec@ietf.org; Thu, 22 Nov 2007 04:31:44 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Iv8PO-0005qF-EI for ipsec@ietf.org; Thu, 22 Nov 2007 04:31:43 -0500 Received: from MBP.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lAM9VcoC024015; Thu, 22 Nov 2007 11:31:38 +0200 (IST) Message-Id: From: Yoav Nir To: Tero Kivinen , ipsec@ietf.org In-Reply-To: <18244.21780.433641.330743@fireball.kivinen.iki.fi> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [IPsec] CHILD_SA and PFS Date: Thu, 22 Nov 2007 11:31:35 +0200 References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> <18242.57134.201314.799049@fireball.kivinen.iki.fi> <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> <18244.21780.433641.330743@fireball.kivinen.iki.fi> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Cc: Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org PFS is different. For other attributes, if the SPD entry says you need, say, 3DES, and the other side's SPD entry says AES-128-GCM, then you'll fail every time. If you succeed, then your policies are matched. With PFS is different. One side can have an SPD entry saying PFS is a must. The other SPD entry says PFS is must not. At any time except during the initial exchange, this will fail, and rightly so - so the users fix the problem. But if it's in the initial exchange, it suddenly succeeds. This practically guarantees usability problems for any implementation. On Nov 21, 2007, at 5:56 PM, Tero Kivinen wrote: > Yoav Nir writes: >> This assumes that generating a new IKE SA is a painless procedure. >> For >> clients, this could mean keying in a passcode from a token, or >> entering a password or pushing some button on a phone. > > Which will cause the client to fix the problem sooner than later, > which is even better. > >> Even if generating an IKE SA is painless, it's also bad if you need >> multiple SAs. Only the first SA (the one that happened to trigger >> IKE) >> will succeed. All the others will fail (assuming all require PFS). So >> we have a badly mismatched configuration that occasionally works. > > If the policies are different, any of the later SAs can fail too, > regardless of PFS. I do not really see that big difference in PFS. In > normal case the client should not really care what is configured for > the PFS group, it should be configured to: suggest without PFS, allow > also any group supported. Then the server can request what kind of > policy it wants. > -- > kivinen@safenet-inc.com > > Scanned by Check Point Total Security Gateway. > _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Shimxch@legend.edu.my Thu Nov 22 07:30:30 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvBCQ-00034g-I7 for ipsec-archive@lists.ietf.org; Thu, 22 Nov 2007 07:30:30 -0500 Received: from host155-113-static.104-82-b.business.telecomitalia.it ([82.104.113.155]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IvBCO-0004gF-Ue for ipsec-archive@lists.ietf.org; Thu, 22 Nov 2007 07:30:29 -0500 Received: from piccin by legend.edu.my with ASMTP id D9F99D85 for ; Thu, 22 Nov 2007 13:30:49 +0100 Received: from piccin ([111.163.151.149]) by legend.edu.my with ESMTP id FE8C301CB322 for ; Thu, 22 Nov 2007 13:30:49 +0100 Message-ID: <000c01c82d03$7607beb0$9b716852@piccin> From: "Bento Shim" To: ipsec-archive@lists.ietf.org Subject: unlubric Date: Thu, 22 Nov 2007 13:30:26 +0100 Message-ID: <000c01c82d03$7607beb0$9b716852@piccin> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.6626 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 3.1 (+++) X-Scan-Signature: 01485d64dfa90b45a74269b3ca9d5574 Put your lassie on fire of pleasement! http://www.loneskin.com/ From ipsec-bounces@ietf.org Thu Nov 22 09:45:17 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvDI7-0000vR-Cl; Thu, 22 Nov 2007 09:44:31 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IvDI6-0000sr-LU for ipsec-confirm+ok@megatron.ietf.org; Thu, 22 Nov 2007 09:44:30 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvDI6-0000qJ-9u for ipsec@ietf.org; Thu, 22 Nov 2007 09:44:30 -0500 Received: from fireball.acr.fi ([83.145.195.1] helo=mail.kivinen.iki.fi) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IvDI5-0000id-Li for ipsec@ietf.org; Thu, 22 Nov 2007 09:44:30 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lAMEiHga020809 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 22 Nov 2007 16:44:17 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lAMEiD23016714; Thu, 22 Nov 2007 16:44:13 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18245.38333.693708.194754@fireball.kivinen.iki.fi> Date: Thu, 22 Nov 2007 16:44:13 +0200 From: Tero Kivinen To: Yoav Nir Subject: Re: [IPsec] CHILD_SA and PFS In-Reply-To: References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> <18242.57134.201314.799049@fireball.kivinen.iki.fi> <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> <18244.21780.433641.330743@fireball.kivinen.iki.fi> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 7 min X-Total-Time: 9 min X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Cc: ipsec@ietf.org, Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Yoav Nir writes: > PFS is different. For other attributes, if the SPD entry says you > need, say, 3DES, and the other side's SPD entry says AES-128-GCM, then > you'll fail every time. If you succeed, then your policies are matched. Not really. If your clients SPD says: Local Remote Action ----- ------ ------ 192.168.2.1 10.0.0.0/8 PROTECT(ESP,AES) and the servers SPD says: Local Remote Action ----- ------ ------ 10.0.0.2 192.168.2.1 PROTECT(ESP,3DES) 10.0.0.0/8 192.168.2.1 PROTECT(ESP,AES) Then if you happen to send first packet from client to 10.0.0.5 addres, the client will negotiate ESP IPsec SA with AES, and with traffic selectors TSi = (192.168.2.1-192.168.2.1), TSr = (10.0.0.0-10.0.0.1, 10.0.0.3-10.0.0.255), as the server will narrow it down to that when proposed clients traffic selectors. Now if the either end tries to negotiate SA between 192.168.2.1 and 10.0.0.2 that will fail. > With PFS is different. One side can have an SPD entry saying PFS is a > must. The other SPD entry says PFS is must not. At any time except > during the initial exchange, this will fail, and rightly so - so the > users fix the problem. But if it's in the initial exchange, it > suddenly succeeds. This practically guarantees usability problems for > any implementation. PFS is no different there. It is just like any similar policy mismatch error. In the case above the user thinks he has ok policy as he can use most of the services from the office network, but for some reason he cannot connect to the 10.0.0.2 server, even when everything else works. -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ShannoncobwebPonce@peoplespot.com Thu Nov 22 18:34:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvLYb-00028m-G4; Thu, 22 Nov 2007 18:34:05 -0500 Received: from [200.87.56.110] (helo=leyes) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IvLYY-00030U-Ek; Thu, 22 Nov 2007 18:34:03 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host28865308.peoplespot.com (8.13.1/8.13.1) with SMTP id QzwmsxrH59.248168.Xdd.AH4.8163526767708 for ; Thu, 22 Nov 2007 19:33:31 +0400 Message-ID: <162ba01c82d60$2c167a00$a86f990a@leyes> From: "Josephine Spivey" To: Cc: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_162B6_01C82D60.2C167A00-- From FletchersprainOchoa@wikipedia.org Fri Nov 23 04:29:44 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvUr2-0002X4-Kr; Fri, 23 Nov 2007 04:29:44 -0500 Received: from 81.203.32.53.dyn.user.ono.com ([81.203.32.53] helo=xxxx146e0323bc) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IvUr2-0001yb-0Y; Fri, 23 Nov 2007 04:29:44 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host11189850.wikipedia.org (8.13.1/8.13.1) with SMTP id bJCbnZOU52.196084.Fcc.G8Y.5460489120518 for ; Fri, 23 Nov 2007 10:30:11 -0100 Message-ID: <4c26801c82db3$7dcbc000$3520cb51@xxxx146e0323bc> From: "Errol Mays" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_4C264_01C82DB3.7DCBC000-- From ghislain_devereux@richardlangridge.com Fri Nov 23 14:53:39 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iveap-0003IM-Go for ipsec-archive@lists.ietf.org; Fri, 23 Nov 2007 14:53:39 -0500 Received: from [81.215.99.232] (helo=dsl.dynamic8121599232.ttnet.net.tr) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Iveao-0005x1-OV for ipsec-archive@lists.ietf.org; Fri, 23 Nov 2007 14:53:39 -0500 Received: from emre-fc560fe434 ([180.152.8.199]:28006 "EHLO emre-fc560fe434" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by dsl.dynamic8121599232.ttnet.net.tr with ESMTP id S22WGHLGNSYUXTZK (ORCPT ); Fri, 23 Nov 2007 21:53:36 +0200 Message-ID: <000201c82e0a$791f6370$e863d751@emrefc560fe434> From: "ghislain devereux" To: Subject: buiron Date: Fri, 23 Nov 2007 21:53:09 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0008_01C82E1B.3CA83370" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 2.1 (++) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a ------=_NextPart_000_0008_01C82E1B.3CA83370 Content-Type: text/plain; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable feeling generous with your xmas gifts? heres an assortment of stunning = watches http://www.ikthiar.com/ ------=_NextPart_000_0008_01C82E1B.3CA83370 Content-Type: text/html; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable
feeling generous with your xmas gifts? heres an = assortment of stunning watches http://www.ikthiar.com/=
------=_NextPart_000_0008_01C82E1B.3CA83370-- From RandellbackwoodSykes@rulers.org Sat Nov 24 01:26:35 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvoTL-0007p9-24; Sat, 24 Nov 2007 01:26:35 -0500 Received: from pool-96-233-41-190.bstnma.fios.verizon.net ([96.233.41.190] helo=dj799mb1.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IvoTK-0008RW-NZ; Sat, 24 Nov 2007 01:26:34 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host86637100.rulers.org (8.13.1/8.13.1) with SMTP id EGffK7gn29.137447.C15.GfU.6858312859367 for ; Sat, 24 Nov 2007 01:26:14 +0500 Message-ID: <1810d01c82e62$f53baa60$0201a8c0@DJ799MB1> From: "Eugenio Galloway" To: Subject: Your order Date: Sat, 24 Nov 2007 01:26:14 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_18109_01C82E62.F53BAA60" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_18109_01C82E62.F53BAA60 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_18109_01C82E62.F53BAA60 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_18109_01C82E62.F53BAA60-- From McMillin@glueck.cc Sat Nov 24 13:15:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IvzWz-0006id-3V for ipsec-archive@lists.ietf.org; Sat, 24 Nov 2007 13:15:05 -0500 Received: from [82.115.16.217] (helo=[82.115.16.217]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IvzWu-0006sE-SQ for ipsec-archive@lists.ietf.org; Sat, 24 Nov 2007 13:15:05 -0500 Received: from a-8c0e40ca82a84 ([118.197.133.105] helo=a-8c0e40ca82a84) by [82.115.16.217] ( sendmail 8.13.3/8.13.1) with esmtpa id 1kQyZC-000UNT-Im for ipsec-archive@lists.ietf.org; Sat, 24 Nov 2007 10:15:12 -0800 Message-ID: <000401c82ec5$ea41e080$d9107352@a8c0e40ca82a84> From: "Audy McMillin" To: Subject: ncpdshol Date: Sat, 24 Nov 2007 10:14:55 -0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C82E82.DC1EA080" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 2.1 (++) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a ------=_NextPart_000_0003_01C82E82.DC1EA080 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable he would love a new watch, especially if the brand is ROLEX = http://hpahora.com/ ------=_NextPart_000_0003_01C82E82.DC1EA080 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
he would love a new watch, especially if the = brand is=20 ROLEX http://hpahora.com/
------=_NextPart_000_0003_01C82E82.DC1EA080-- From ipsec-bounces@ietf.org Sat Nov 24 17:09:38 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3BA-0003mZ-Ts; Sat, 24 Nov 2007 17:08:48 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iw3B9-0003ge-CC for ipsec-confirm+ok@megatron.ietf.org; Sat, 24 Nov 2007 17:08:47 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3B8-0003gM-Sy for ipsec@lists.ietf.org; Sat, 24 Nov 2007 17:08:46 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iw3B4-0004Ci-3o for ipsec@lists.ietf.org; Sat, 24 Nov 2007 17:08:46 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1Iw3Au-0000mD-9H for ipsec@lists.ietf.org; Sat, 24 Nov 2007 22:08:32 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Nov 2007 22:08:32 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Nov 2007 22:08:32 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Sat, 24 Nov 2007 17:08:25 -0500 Lines: 67 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070510 Iceape/1.0.9 (Debian-1.0.9-0etch1) In-Reply-To: X-Spam-Score: -0.0 (/) X-Scan-Signature: f60d0f7806b0c40781eee6b9cd0b2135 Cc: Subject: [IPsec] Re: test vectors for IKEv2 SKEYSEED derivation X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Michael Richardson wrote: > I'm looking for some test vectors for SKEYSEED calculation. I asked > google a bit, but I didn't find anything published on the IPsec list. > Perhaps there are some materials from one of the bakeoffs. I wish that > we had put some vectors into rfc4306. I saw that there are some vectors > in the SHA256 drafts, but I don't think that they give enough detail to > confirm that an implementation has done the right thing. I received a number of replies privately and Tero Kivinen ran my vectors, and found problems. Some other people did too, and didn't find any problems --- I will reply to you and let you know --- if you found no problems with my vectors, then your code is likely broken too. My code had two mistakes, of course in the one part which I didn't dump, which was the key part of the initial SKEYSEED calculation. (i.e. Ni|Nr) The first error was a bits vs bytes error, easily corrected. The second problem is more complex, and I think it represents some under specification in rfc4306. (Please tell me if I missed some text) The under specification may be minor or major, I'm not sure yet. Part A The problem is that I didn't know what the key size for MD5 and SHA1 is. As far as I knew, it was open --- I can use any key size, since HMAC just prepends the key to the data. This for me meant that I should have no problems concatenating Ni|Nr Part B However, in order to know how much keying material to generate, and how much is going to be SK_d, SK_ai, SK_ar, I need to know how big each one is going to be. For *ESP* the key size of integrity algorithms is MD5,SHA1 = (16 bytes, 20 bytes). SK_d is used in prf+ as specified in 2.17. As that is based upon prf, I might assume that the "keysize" for prf is like for ESP, i.e. 16 and 20 bytes. Go back to Part A. If md5 has a 16-byte keysize, then if I provide two 16-byte nonces (the smallest allowable), then I should take 8 bytes from Ni, and 8 bytes from Nr. Tero's vector clearly didn't do that --- it had 32 bytes of input, 16 from each nonce. As I am writing this, I am inserting text from RFC4306, such as below: This concerns RFC4306 sections 2.13/2.14. 2.13: says: We assume that each encryption algorithm and integrity protection algorithm uses a fixed-size key and that any randomly chosen value of that fixed size can serve as an appropriate key. For algorithms that accept a variable length key, a fixed key size MUST be specified as part of the cryptographic transform negotiated. I understood this to apply to things like AES. Does this *ALSO* apply to MD5 and SHA1? Are these considered to be variable length, and we need to include a keysize attribute for the *PRF* and *INTEGRITY* options for the PARENT SA? Section 3.3.5 "Key Length" says that it applies to Encryption Algorithms only. (Also is it just me, or has the table in 3.3.5, Attribute Type/Value/Format been word wrapped on us?) _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Sat Nov 24 17:29:54 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3VW-0006jF-Qq; Sat, 24 Nov 2007 17:29:50 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iw3VV-0006bl-ET for ipsec-confirm+ok@megatron.ietf.org; Sat, 24 Nov 2007 17:29:49 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3VV-0006Za-3D for ipsec@lists.ietf.org; Sat, 24 Nov 2007 17:29:49 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iw3VS-0004kk-NS for ipsec@lists.ietf.org; Sat, 24 Nov 2007 17:29:49 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1Iw3VL-0005ec-R1 for ipsec@lists.ietf.org; Sat, 24 Nov 2007 22:29:39 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Nov 2007 22:29:39 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Nov 2007 22:29:39 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Sat, 24 Nov 2007 17:29:31 -0500 Lines: 22 Message-ID: References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070510 Iceape/1.0.9 (Debian-1.0.9-0etch1) In-Reply-To: <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> X-Spam-Score: -0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Cc: Subject: [IPsec] Re: CHILD_SA and PFS X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Yoav Nir wrote: > 1. Add a notification to IKEv2 with a name like WILL_DO_PFS_ON_REKEY > that can be added to the AUTH exchange. It will specify the groups > supported (maybe only zero for no PFS). A peer that recognizes this > notification may fail the exchange if the next CHILD_SA is doomed to fail. This is the best solution. It can be done unilaterally by the responder. An initiator that doesn't recognize it falls into the situation that Kivinen mentioned. (which is the same situation as we have now) An initiator that understands this notification can realize that it is misconfigured, and either fix itself (if it had a "MAY DO PFS" option), or let the user know immediately and fail the communications. No IKE2.1 necessary. If there in fact so many things that are waiting that need a 2.1 to do perhaps someone could list them. Minor version changes should not be a big deal. We tried to make sure of that. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Sat Nov 24 17:55:05 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3tv-0000MT-Je; Sat, 24 Nov 2007 17:55:03 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iw3tu-0000ML-Fq for ipsec-confirm+ok@megatron.ietf.org; Sat, 24 Nov 2007 17:55:02 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iw3tu-0000MD-3r for ipsec@lists.ietf.org; Sat, 24 Nov 2007 17:55:02 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iw3tr-0005Pg-Oc for ipsec@lists.ietf.org; Sat, 24 Nov 2007 17:55:02 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1Iw3tm-0003Om-AY for ipsec@lists.ietf.org; Sat, 24 Nov 2007 22:54:54 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Nov 2007 22:54:54 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Nov 2007 22:54:54 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Sat, 24 Nov 2007 17:54:39 -0500 Lines: 36 Message-ID: <4748ABAF.7020500@sandelman.ca> References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070510 Iceape/1.0.9 (Debian-1.0.9-0etch1) In-Reply-To: X-Spam-Score: -0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Cc: Subject: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Paul Hoffman wrote: > In Section 2.13, replaced text about variable length keys with > clearer explanation and requirement on non-HMAC PRFs. Also added > "preferred" to Section 2.14 for the key length, and removed redundant > text. > > In Section 2.14, removed the "half and half" description and replaced > it with exceptions for RFC4434 and RFC4615. > > Removed the now-redundant "All PRFs used with IKEv2 MUST take > variable-sized keys" from Section 2.15. okay, these clarifications helped me just now, and answer the questions for the email that I posted ten minutes ago. Tero, based upon this, is your SKEYSEED input you sent me correct? SshIkev2Crypto/ikev2-crypto.c:328/test_ikev2_skeyseed_agree: Key for PRF (Ni | Nr) 00000000: b5ce 8419 095c 6e2b 6b62 d305 5305 b3c4 .....\n+kb..S... 00000010: 47e9 f925 8ca2 3858 f675 b166 b02c c292 G..%..8X.u.f.,.. My inputs were: unsigned char tc2_ni[] = { 0xb5, 0xce, 0x84, 0x19, 0x09, 0x5c, 0x6e, 0x2b, 0x6b, 0x62, 0xd3, 0x05, 0x53, 0x05, 0xb3, 0xc4, }; unsigned char tc2_nr[] = { 0x47, 0xe9, 0xf9, 0x25, 0x8c, 0xa2, 0x38, 0x58, 0xf6, 0x75, 0xb1, 0x66, 0xb0, 0x2c, 0xc2, 0x92, }; and this was md5, so the key size is 16 bytes. You have an input key size of 32 bytes. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Sun Nov 25 04:15:02 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwDZZ-0005KT-7j; Sun, 25 Nov 2007 04:14:41 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwDZX-0005KM-Qw for ipsec-confirm+ok@megatron.ietf.org; Sun, 25 Nov 2007 04:14:39 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwDZS-0005Iz-HX for ipsec@ietf.org; Sun, 25 Nov 2007 04:14:34 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IwDZR-0003mB-QH for ipsec@ietf.org; Sun, 25 Nov 2007 04:14:34 -0500 Received: from MBP.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lAP9EToC023128; Sun, 25 Nov 2007 11:14:29 +0200 (IST) Message-Id: <0632668F-AE68-46C6-84F3-5F1B4B8DB6B2@checkpoint.com> From: Yoav Nir To: Tero Kivinen In-Reply-To: <18245.38333.693708.194754@fireball.kivinen.iki.fi> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [IPsec] CHILD_SA and PFS Date: Sun, 25 Nov 2007 11:14:26 +0200 References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> <18242.57134.201314.799049@fireball.kivinen.iki.fi> <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> <18244.21780.433641.330743@fireball.kivinen.iki.fi> <18245.38333.693708.194754@fireball.kivinen.iki.fi> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Cc: ipsec@ietf.org, Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org That's my point. The client can never connect to 10.0.0.2. It always fails, so the user tells the administrator that something is wrong, and (hopefully) it gets fixed. With PFS, the connection succeeds and everything works. Then suddenly, it stops. If I can get to the file server at 10.0.0.5 but not to the mail server at 10.0.0.2, I'm going to call the administrator. If the connection just stops after 30 minutes, I'm going to blame the ISP or the client vendor. I wouldn't associate a misconfiguration with this. On Nov 22, 2007, at 4:44 PM, Tero Kivinen wrote: > If your clients SPD says: > > Local Remote Action > ----- ------ ------ > 192.168.2.1 10.0.0.0/8 PROTECT(ESP,AES) > > and the servers SPD says: > > Local Remote Action > ----- ------ ------ > 10.0.0.2 192.168.2.1 PROTECT(ESP,3DES) > 10.0.0.0/8 192.168.2.1 PROTECT(ESP,AES) > > Then if you happen to send first packet from client to 10.0.0.5 > addres, the client will negotiate ESP IPsec SA with AES, and with > traffic selectors TSi = (192.168.2.1-192.168.2.1), TSr = > (10.0.0.0-10.0.0.1, 10.0.0.3-10.0.0.255), as the server will narrow it > down to that when proposed clients traffic selectors. > > Now if the either end tries to negotiate SA between 192.168.2.1 and > 10.0.0.2 that will fail. > PFS is no different there. It is just like any similar policy mismatch > error. In the case above the user thinks he has ok policy as he can > use most of the services from the office network, but for some reason > he cannot connect to the 10.0.0.2 server, even when everything else > works. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From AlexabbeDaniels@rulers.org Sun Nov 25 05:01:44 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwEJ6-0001jX-TU; Sun, 25 Nov 2007 05:01:44 -0500 Received: from [77.226.36.136] (helo=windowsm266a) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IwEJ6-0001UC-1A; Sun, 25 Nov 2007 05:01:44 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host12659367.rulers.org (8.13.1/8.13.1) with SMTP id 6izBRyCe07.852785.dNq.0b0.9839786481780 for ; Sun, 25 Nov 2007 11:01:25 -0100 Message-ID: <6e2a01c82f4a$31c15ba0$c000a8c0@windowsm266a> From: "Theodore Mills" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_6E26_01C82F4A.31C15BA0-- From NoahwantRoy@closer.com Sun Nov 25 07:32:32 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwGf2-0006q0-8c; Sun, 25 Nov 2007 07:32:32 -0500 Received: from host-84-220-102-166.cust-adsl.tiscali.it ([84.220.102.166] helo=pe07c13bcdfc44) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IwGf1-0005BQ-F1; Sun, 25 Nov 2007 07:32:32 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host77246224.closer.com (8.13.1/8.13.1) with SMTP id JFbwXcD568.637912.JIW.yyy.8875966019996 for ; Sun, 25 Nov 2007 13:33:28 -0100 Message-ID: <831e401c82f5f$7849cc00$6501a8c0@pe07c13bcdfc44> From: "Elbert Bass" To: , =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_831E0_01C82F5F.7849CC00-- From Douradowmsiw@schattle.com Sun Nov 25 07:59:23 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwH51-00034E-NG for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 07:59:23 -0500 Received: from [189.70.223.120] (helo=18970223120.user.veloxzone.com.br) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IwH50-0005ty-SV for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 07:59:23 -0500 Received: from Silverstone ([137.163.114.1] helo=Silverstone) by 18970223120.user.veloxzone.com.br ( sendmail 8.13.3/8.13.1) with esmtpa id 1TTaIn-000VZG-mR for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 09:59:53 -0300 Message-ID: <000c01c82f62$fe6c4cb0$78df46bd@Silverstone> From: "keping Dourado" To: Subject: ownpoint Date: Sun, 25 Nov 2007 09:59:20 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C82F49.D91F14B0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 2.1 (++) X-Scan-Signature: 93238566e09e6e262849b4f805833007 ------=_NextPart_000_0004_01C82F49.D91F14B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable christmas time means gifts, get them a rolex http://suvaro.com/ ------=_NextPart_000_0004_01C82F49.D91F14B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
christmas time means gifts, get them a rolex http://suvaro.com/
------=_NextPart_000_0004_01C82F49.D91F14B0-- From jhlkj@www.thejukebox.at Sun Nov 25 14:44:36 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwNPA-0002Xp-98 for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 14:44:36 -0500 Received: from [88.241.181.171] (helo=dsl88.241-46507.ttnet.net.tr) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IwNP8-0000NJ-Pn for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 14:44:35 -0500 Received: by 10.115.151.225 with SMTP id DxaYwDGIIcZhL; Sun, 25 Nov 2007 21:44:39 +0200 (GMT) Received: by 192.168.29.16 with SMTP id uBcDMUEQQHdeMe.5449448611051; Sun, 25 Nov 2007 21:44:37 +0200 (GMT) Message-ID: <000e01c82f9b$9aafd4b0$abb5f158@idt> From: "Xeon jhlkj" To: Subject: loamiest Date: Sun, 25 Nov 2007 21:44:34 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C82FAC.5E38A4B0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Antivirus: avast! (VPS 071125-0, 25.11.2007), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 3.6 (+++) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a ------=_NextPart_000_0003_01C82FAC.5E38A4B0 Content-Type: text/plain; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable Christmas is not far away! Think about your rolex gift needs now! = http://ritarra.com/ ------=_NextPart_000_0003_01C82FAC.5E38A4B0 Content-Type: text/html; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable
Christmas is not far away! Think about = your=20 rolex gift needs now! http://ritarra.com/
<= /HTML> ------=_NextPart_000_0003_01C82FAC.5E38A4B0-- From mamawcity@b1-t.co.jp Sun Nov 25 23:53:25 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwVyH-0001Kf-QN for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 23:53:25 -0500 Received: from [122.168.13.66] (helo=ABTS-mp-dynamic-066.13.168.122.airtelbroadband.in) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1IwVyD-0001r2-Ry for ipsec-archive@lists.ietf.org; Sun, 25 Nov 2007 23:53:25 -0500 Received: (qmail 3299 invoked from network); Mon, 26 Nov 2007 10:23:00 +0530 Received: from unknown (HELO enwfu) (237.35.91.75) by ABTS-mp-dynamic-066.13.168.122.airtelbroadband.in with SMTP; Mon, 26 Nov 2007 10:23:00 +0530 Message-ID: <474A512C.3030807@b1-t.co.jp> Date: Mon, 26 Nov 2007 10:23:00 +0530 From: User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: ipsec-archive@lists.ietf.org Subject: Santa came early Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 3.8 (+++) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f et g u Bails Out Hotels In Energy Crisis Important factors you should be aware of before Monday: 1. The worlds Energy resources are of major concern 2. Without much relief in site from authorities, businesses are looking for their own solutions to energy problems. 3. EnerBrite's proven system reduces energy costs by as much as 30%. 4. Hotels and other large facilities are already boast in the news about the relief E T gU has brought to there energy problems. 5. EnerBrite is issuing a extensive media release to boosts investor awareness this coming week. The past week has been an absolute frenzy on E tGU. Trading has gone through the roof and Market Makers have been buying up large blocks to take control of the trading next week. Act fast on Monday and get in on the action expected next week. From ipsec-bounces@ietf.org Mon Nov 26 02:39:00 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwYYI-0001B8-7S; Mon, 26 Nov 2007 02:38:46 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwYYG-0001Av-VD for ipsec-confirm+ok@megatron.ietf.org; Mon, 26 Nov 2007 02:38:44 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwYYG-00018V-4B for ipsec@ietf.org; Mon, 26 Nov 2007 02:38:44 -0500 Received: from mail2.ics.ntts.co.jp ([202.32.24.42]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IwYYF-00007C-Av for ipsec@ietf.org; Mon, 26 Nov 2007 02:38:44 -0500 Received: from sadoku34.silk.ntts.co.jp (sadoku34 [10.7.18.34]) by mail2.ics.ntts.co.jp (8.13.8/NTTSOFT) with ESMTP id lAQ7cfAc018802; Mon, 26 Nov 2007 16:38:41 +0900 (JST) Received: (from root@localhost) by sadoku34.silk.ntts.co.jp (8.13.8/NTTSOFT) id lAQ7cfeN002856; Mon, 26 Nov 2007 16:38:41 +0900 (JST) Received: from mail26.silk.ntts.co.jp [10.7.18.26] by sadoku34.silk.ntts.co.jp with SMTP id SAA02855; Mon, 26 Nov 2007 16:38:41 +0900 Received: from mail26.silk.ntts.co.jp (localhost [127.0.0.1]) by mail26.silk.ntts.co.jp (8.13.8/NTTSOFT) with ESMTP id lAQ7ceuj016557; Mon, 26 Nov 2007 16:38:40 +0900 (JST) Received: from [127.0.0.1] (lepus.ms.ntts.co.jp [10.7.221.39]) by mail26.silk.ntts.co.jp (8.13.8/NTTSOFT) with ESMTP id lAQ7ca9V016478; Mon, 26 Nov 2007 16:38:40 +0900 (JST) Message-ID: <474A77F9.2060309@po.ntts.co.jp> Date: Mon, 26 Nov 2007 16:38:33 +0900 From: KATO Akihiro User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: ipsec@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Subject: [IPsec] [Fwd: New Version Notification for draft-kato-ipsec-camellia-modes-04] X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org IPsec ML lists, We would appreciate any comments you may have regarding the fourth revision of this draft, either privately or to the mailing list. I apologize if you got this email more than once. This document is based on RFC 4312 and draft-kato-camellia-ctrccm-00.txt . Regards, KATO Akihiro. -------- Original Message -------- A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : The Additional Modes of Operation for Camellia and Its Use With IPsec Author(s) : . Kato, M. Kanda Filename : draft-kato-ipsec-camellia-modes-04.txt Pages : 27 Date : 2007-11-16 This document describes the use of the Camellia block cipher algorithm in Cipher Block Chaining (CBC) mode, Counter (CTR) mode and Counter with CBC-MAC (CCM) mode, as an IPsec Encapsulating Security Payload (ESP) mechanism to provide confidentiality, data origin authentication, and connectionless integrity. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-kato-ipsec-camellia-modes-04.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request at ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-kato-ipsec-camellia-modes-04.txt". _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From Manoj783@attraktieshop.com Mon Nov 26 07:00:27 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwcdX-0000Lv-1y for ipsec-archive@lists.ietf.org; Mon, 26 Nov 2007 07:00:27 -0500 Received: from host217-137-static.121-81-b.business.telecomitalia.it ([81.121.137.217]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IwcdV-0006lY-Qi for ipsec-archive@lists.ietf.org; Mon, 26 Nov 2007 07:00:26 -0500 Received: from PortatileCaggia ([179.141.160.15]:30518 "EHLO PortatileCaggia" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by host217-137-static.121-81-b.business.telecomitalia.it with ESMTP id S22ONZCVVYOCXJTK (ORCPT ); Mon, 26 Nov 2007 13:01:00 +0100 Message-ID: <000801c83023$ec0f1860$d9897951@PortatileCaggia> From: "Manoj yucedag" To: Subject: nisuopse Date: Mon, 26 Nov 2007 13:00:22 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0005_01C8302C.4DD38060" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 2.0 (++) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a ------=_NextPart_000_0005_01C8302C.4DD38060 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable xmas is a time for giving, so why not give a classy Rolex! = http://rgwkor.com/ ------=_NextPart_000_0005_01C8302C.4DD38060 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
xmas is a time for giving, so why not give a = classy=20 Rolex! http://rgwkor.com/
------=_NextPart_000_0005_01C8302C.4DD38060-- From ipsec-bounces@ietf.org Mon Nov 26 10:11:37 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwfcO-0008Gx-IA; Mon, 26 Nov 2007 10:11:28 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwfcM-0008Gs-Np for ipsec-confirm+ok@megatron.ietf.org; Mon, 26 Nov 2007 10:11:26 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwfcM-0008Gj-AA for ipsec@lists.ietf.org; Mon, 26 Nov 2007 10:11:26 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwfcJ-0008Nb-T6 for ipsec@lists.ietf.org; Mon, 26 Nov 2007 10:11:26 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lAQFBKw6023524 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 26 Nov 2007 17:11:20 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lAQFBH1G019408; Mon, 26 Nov 2007 17:11:17 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18250.57877.627034.798604@fireball.kivinen.iki.fi> Date: Mon, 26 Nov 2007 17:11:17 +0200 From: Tero Kivinen To: Michael Richardson Subject: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt In-Reply-To: <4748ABAF.7020500@sandelman.ca> References: <4748ABAF.7020500@sandelman.ca> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 2 min X-Total-Time: 1 min X-Spam-Score: -1.4 (-) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Cc: ipsec@lists.ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Michael Richardson writes: > Tero, based upon this, is your SKEYSEED input you sent me correct? The RFC4306 says that SKEYSEED is generated as: SKEYSEED = prf(Ni | Nr, g^ir) I.e. the key to the PRF is "Ni | Nr". The only rule that says you should truncate or modify the key only applies to PRFs which take a fixed lenght key, but HMAC-MD5 and all other HMACs take variable length keys, so yes, I think that SKEYSEED key is correct. > SshIkev2Crypto/ikev2-crypto.c:328/test_ikev2_skeyseed_agree: Key for PRF (Ni > | Nr) > 00000000: b5ce 8419 095c 6e2b 6b62 d305 5305 b3c4 .....\n+kb..S... > 00000010: 47e9 f925 8ca2 3858 f675 b166 b02c c292 G..%..8X.u.f.,.. > > My inputs were: > > unsigned char tc2_ni[] = { > 0xb5, 0xce, 0x84, 0x19, 0x09, 0x5c, 0x6e, 0x2b, > 0x6b, 0x62, 0xd3, 0x05, 0x53, 0x05, 0xb3, 0xc4, > }; > unsigned char tc2_nr[] = { > 0x47, 0xe9, 0xf9, 0x25, 0x8c, 0xa2, 0x38, 0x58, > 0xf6, 0x75, 0xb1, 0x66, 0xb0, 0x2c, 0xc2, 0x92, > }; > > and this was md5, so the key size is 16 bytes. > You have an input key size of 32 bytes. There is no key size for HMAC-MD5 PRF (Transform type 2). I.e. it takes variable length of key. On the other hand there is key size for the HMAC-MD5 authentication algorithm (Transform type 3) (i.e. the key size needed for the SK_ai and SK_ar is specified in the RFC2403). The thing that is missing in the RFC4306 which says how long the SK_d needs to be. The RFC2104 referenced in the HMAC-MD5 PRF definitation says that: ---------------------------------------------------------------------- 3. Keys The key for HMAC can be of any length (keys longer than B bytes are first hashed using H). However, less than L bytes is strongly discouraged as it would decrease the security strength of the function. Keys longer than L bytes are acceptable but the extra length would not significantly increase the function strength. (A longer key may be advisable if the randomness of the key is considered weak.) ---------------------------------------------------------------------- but even it does not define the "default" or "preferred" key length for the HMAC-* PRFs. The common use has been to use full data as input if there is something with length already, and if not (like when generating SK_d to be used for PRFs later) we have used the output size of the underlaying hash function of the HMAC (as shorter keys are strongly discouraged, and longer keys do not significantly increaase the strength). -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Mon Nov 26 10:26:13 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwfqb-0005cg-2e; Mon, 26 Nov 2007 10:26:09 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iwfqa-0005cM-7x for ipsec-confirm+ok@megatron.ietf.org; Mon, 26 Nov 2007 10:26:08 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwfqY-0005b2-NO for ipsec@lists.ietf.org; Mon, 26 Nov 2007 10:26:07 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwfqX-0000LN-FI for ipsec@lists.ietf.org; Mon, 26 Nov 2007 10:26:06 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lAQFQ472008107 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 26 Nov 2007 17:26:04 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lAQFQ45w022154; Mon, 26 Nov 2007 17:26:04 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18250.58764.542898.587852@fireball.kivinen.iki.fi> Date: Mon, 26 Nov 2007 17:26:04 +0200 From: Tero Kivinen To: Michael Richardson Subject: [IPsec] Re: test vectors for IKEv2 SKEYSEED derivation In-Reply-To: References: X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 10 min X-Total-Time: 14 min X-Spam-Score: -1.4 (-) X-Scan-Signature: a2c12dacc0736f14d6b540e805505a86 Cc: ipsec@lists.ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Michael Richardson writes: > Part A > The problem is that I didn't know what the key size for MD5 and SHA1 is. > As far as I knew, it was open --- I can use any key size, since > HMAC just prepends the key to the data. This for me meant that I should > have no problems concatenating Ni|Nr Depends what HMAC-MD5 / HMAC-SHA1 you talk about. For the AUTH_HMAC_MD5_96, and AUTH_MHAC_SHA1_96 the RFCs 2403 and 2404 clearly specify that the input key size is 128 bits and 160 bits, and no other key lengths are supported. For the PRF_HMAC_MD5 and PRF_HMAC_SHA1 the RFC2104 does NOT specify the key lenght, but says any key lenght is acceptable. > Part B > However, in order to know how much keying material to generate, and how much > is going to be SK_d, SK_ai, SK_ar, I need to know how big each one is going > to be. For *ESP* the key size of integrity algorithms is MD5,SHA1 = (16 > bytes, 20 bytes). That same applies to the SK_ai, and SK_ar, as they use AUTH_HMAC_MD5_96 / AUTH_HMAC_SHA1_96. The only problem is the SK_d, i.e. how many bytes of keying material needs to be generated for the SK_d. > SK_d is used in prf+ as specified in 2.17. As that is based upon > prf, I might assume that the "keysize" for prf is like for ESP, i.e. > 16 and 20 bytes. That is what implementations do now, and I think that should be specified in the future documents. > Go back to Part A. If md5 has a 16-byte keysize, then if I provide two > 16-byte nonces (the smallest allowable), then I should take 8 bytes from Ni, > and 8 bytes from Nr. Tero's vector clearly didn't do that --- it had 32 > bytes of input, 16 from each nonce. No. Even when we have some key size associated with the PRF to specify how many bytes we need to generate when generating key to be used for the PRF, that does not make the PRF to require fixed size key. It can still take variable size of key, thus no truncation is done, and full Ni and Nr are used. > As I am writing this, I am inserting text from RFC4306, such as below: > > This concerns RFC4306 sections 2.13/2.14. > > 2.13: says: > > We assume that each encryption algorithm and integrity protection > algorithm uses a fixed-size key and that any randomly chosen value of > that fixed size can serve as an appropriate key. For algorithms that > accept a variable length key, a fixed key size MUST be specified as > part of the cryptographic transform negotiated. > > I understood this to apply to things like AES. It does not apply to AES, which is encryption algorithm. It applies to the RPF_AES128_XCBC which is PRF function. And note there is some problems with that already (RFC4434 vs RFC 3664). > Does this *ALSO* apply to MD5 and SHA1? No. > Are these considered to be variable length, and we need to include a keysize > attribute for the *PRF* and *INTEGRITY* options for the PARENT SA? No. For integrity the key size is fixed by the RFC2403 and RFC2404. For the PRF the key size is whatever is given to the PRF. The only thing we should define is the length of the SK_d. > Section 3.3.5 "Key Length" says that it applies to Encryption > Algorithms only. Yes. > (Also is it just me, or has the table in 3.3.5, Attribute Type/Value/Format > been word wrapped on us?) Yes seems to be, should be: Attribute Type Value Attribute Format -------------------------------------------------------------- RESERVED 0-13 Key Length (in bits) 14 TV RESERVED 15-17 RESERVED TO IANA 18-16383 PRIVATE USE 16384-32767 -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Mon Nov 26 10:31:20 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwfvb-00020T-3w; Mon, 26 Nov 2007 10:31:19 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iwfva-00020N-EY for ipsec-confirm+ok@megatron.ietf.org; Mon, 26 Nov 2007 10:31:18 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwfva-00020E-5C for ipsec@ietf.org; Mon, 26 Nov 2007 10:31:18 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwfvX-0000WJ-VL for ipsec@ietf.org; Mon, 26 Nov 2007 10:31:18 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lAQFUnnx027033 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 26 Nov 2007 17:30:49 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lAQFUkbU007776; Mon, 26 Nov 2007 17:30:46 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18250.59046.844744.249593@fireball.kivinen.iki.fi> Date: Mon, 26 Nov 2007 17:30:46 +0200 From: Tero Kivinen To: Yoav Nir Subject: Re: [IPsec] CHILD_SA and PFS In-Reply-To: <0632668F-AE68-46C6-84F3-5F1B4B8DB6B2@checkpoint.com> References: <473DC1D4.5070200@certicom.com> <4741B094.306@certicom.com> <7C2F574B-93DC-4F9A-BBE0-2B05524A6278@checkpoint.com> <18242.57134.201314.799049@fireball.kivinen.iki.fi> <78C4038C-89E7-48E1-8A0B-BBF26DAD5B32@checkpoint.com> <18244.21780.433641.330743@fireball.kivinen.iki.fi> <18245.38333.693708.194754@fireball.kivinen.iki.fi> <0632668F-AE68-46C6-84F3-5F1B4B8DB6B2@checkpoint.com> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 5 min X-Total-Time: 4 min X-Spam-Score: -1.4 (-) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Cc: ipsec@ietf.org, Pasi.Eronen@nokia.com X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Yoav Nir writes: > That's my point. The client can never connect to 10.0.0.2. It always > fails, so the user tells the administrator that something is wrong, > and (hopefully) it gets fixed. But from the users point of view, he has working connection to the office network, as the everything works, but then suddenly when he wants do something else that does not work. > With PFS, the connection succeeds and everything works. Then suddenly, > it stops. It does not stop, it pauses for sometime and fixes the situation after a while. > If I can get to the file server at 10.0.0.5 but not to the mail server > at 10.0.0.2, I'm going to call the administrator. If the connection > just stops after 30 minutes, I'm going to blame the ISP or the client > vendor. I wouldn't associate a misconfiguration with this. But if you are connecting to the smtp.company.local and half of the time it works and half of the time it does not, as your dns resolver is using round robin and both 10.0.0.2 and 10.0.0.5 are used for that name, then you blame ISP or the client vendor again. Anyways, blaming the client vendor is quite valid thing to do, as he allowed misconfiguring the client in the way where it allows such policies. If you use the better GUI example given by Pasi, I do not think you will have that many problems. If you just have the "enable PFS" checkbox, then I think the client vendor needs to be blamed. -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From omvfilm@sarhc.org Mon Nov 26 17:04:19 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwm3v-0007ef-KM; Mon, 26 Nov 2007 17:04:19 -0500 Received: from 88-199-126-226.tktelekom.pl ([88.199.126.226] helo=sarhc.org) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iwm3u-0004Kn-Nc; Mon, 26 Nov 2007 17:04:19 -0500 Received: from sztylerc76r67f ([206.67.96.175]:30734 "HELO sztylerc76r67f" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by e27ec758sarhc.org with ESMTP id q4QOPCAV155142 (ORCPT ); Mon, 26 Nov 2007 23:04:18 +0100 Message-ID: <001501c83080$ac2608a0$06741f14@sztylerc76r67f> From: willing on To: imapext-archive@lists.ietf.org Subject: do demanding Date: Mon, 26 Nov 2007 23:04:18 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0012_01C83080.AC2608A0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.1106 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2963 X-Spam-Score: 3.6 (+++) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 This is a multi-part message in MIME format. ------=_NextPart_000_0012_01C83080.AC2608A0 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable painters who had enough self-esteem in their own interpretations, = and applications which enable artists to create a variety of Margaret Thatc= her's mocking condescension. In defiance, he ------=_NextPart_000_0012_01C83080.AC2608A0 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable

will provide invaluable clues to the future. Eventually we are

Are you wanting a bi/gg er pe \nis?

As seen on TV

Ov \er 714,000 Men aro /und the world are already sat \isfied
Gain 2+ Inc /hes In Len /gth
Inc \rease Your Pe /nis Wid /th (Gir \th) By u/p-to 24%
100% Safe To Take, With NO Side Effe /cts
No Pumps! No Surgery! No Exercises!

the only one that has been able to feed me satisfactorily in this ------=_NextPart_000_0012_01C83080.AC2608A0-- From JuliecrestviewLake@zabasearch.com Mon Nov 26 21:57:18 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwqdS-0004ll-L9; Mon, 26 Nov 2007 21:57:18 -0500 Received: from 12-201-77-90.client.mchsi.com ([12.201.77.90] helo=your588b4a13ea) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IwqdS-0001tL-B1; Mon, 26 Nov 2007 21:57:18 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host97641735.zabasearch.com (8.13.1/8.13.1) with SMTP id f8cL78mW86.612757.oyW.JpB.4533837550758 for ; Mon, 26 Nov 2007 20:56:59 +0600 Message-ID: <1141601c830a1$3b3005d0$0201a8c0@YOUR588B4A13EA> From: "Carolyn Ibarra" To: Subject: Your family Date: Mon, 26 Nov 2007 20:56:59 +0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_11412_01C830A1.3B3005D0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_11412_01C830A1.3B3005D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Cialis would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 15 = minutes! The tests showed that the majority of men after taking this = medication were able to have perfect erection during 36 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $95.95 $34.19 30 tabs 60 doses $349.95 $104.66 60 tabs 120 doses $549.95 $180.15 90 tabs 180 doses $789.95 $242.06 180 tabs 360 doses $1325.95 $445.61 When you are young and stressed up… When you are aged and never give up… Cialis gives you confidence in any chance, every time. ------=_NextPart_000_11412_01C830A1.3B3005D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Cialis would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 15 minutes! The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 36 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $95.95 $34.19
30 tabs 60 doses $349.95 $104.66
60 tabs 120 doses $549.95 $180.15
90 tabs 180 doses $789.95 $242.06
180 tabs 360 doses $1325.95 $445.61

When you are young and stressed = up…
When you are aged and never give up…
Cialis gives you confidence in any chance, every time.

------=_NextPart_000_11412_01C830A1.3B3005D0-- From ipsec-bounces@ietf.org Mon Nov 26 23:12:04 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwrnc-0002G8-9p; Mon, 26 Nov 2007 23:11:52 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iwrna-0002Dr-RJ for ipsec-confirm+ok@megatron.ietf.org; Mon, 26 Nov 2007 23:11:50 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iwrna-0002CZ-HS for ipsec@ietf.org; Mon, 26 Nov 2007 23:11:50 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwrjc-00077s-8B for ipsec@ietf.org; Mon, 26 Nov 2007 23:07:44 -0500 Received: from web26604.mail.ukl.yahoo.com ([217.146.176.54]) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iwrjb-0007rz-N1 for ipsec@ietf.org; Mon, 26 Nov 2007 23:07:44 -0500 Received: (qmail 58173 invoked by uid 60001); 27 Nov 2007 04:07:42 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Message-ID; b=NcHSW7IjfJeKwBAhGU9mxhvEN+xWCCMtFgm/z9T10WVouIt3gPz9IzgdaF29OaxuPQV5pvifk9Xqv4IJgYcljOZyZ39YNQiYy0/4p4f7IFcXm4ja8pmNdFrz/fx36t+pHE2P+dwJ2KTnwR5+umP8dM5DSl5/hWJ+hP2+hwq+YD0=; X-YMail-OSG: Gkjdi9gVM1kZNjg7rV00AzTJn3hzHZhd79m1niTGxRnuA2ZOwFgSOa.HJY93qsD.fBjhp6UUarvVcIj3V_sOLWTU3P1jtLbEvZmCeY6vvAte7Jg7 Received: from [129.78.64.102] by web26604.mail.ukl.yahoo.com via HTTP; Tue, 27 Nov 2007 04:07:42 GMT X-Mailer: YahooMailRC/818.27 YahooMailWebService/0.7.157 Date: Tue, 27 Nov 2007 04:07:42 +0000 (GMT) From: "Hisyam F." To: ipsec@ietf.org MIME-Version: 1.0 Message-ID: <657692.56292.qm@web26604.mail.ukl.yahoo.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 X-TMDA-Confirmed: Mon, 26 Nov 2007 23:11:50 -0500 Subject: [IPsec] IKEv2 - possible attack from legitimate node(s)? X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0321091312==" Errors-To: ipsec-bounces@ietf.org --===============0321091312== Content-Type: multipart/alternative; boundary="0-1727647850-1196136462=:56292" --0-1727647850-1196136462=:56292 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi,=0A=0AI'm relatively new to IPsec. I would like to ask regarding the DoS= protection in IPsec. Based on the IKEv2 standard, there is an anti-cloggin= g mechanism via "cookie" notification in Notify payload which prevent DoS a= ttack on message echange (i.e.,phase 1). It seems that the DoS attack is as= sumed to have or mounted from spoof IP address.=0A=0AIn that sense, I would= like to know whether IPsec (especially the IKEv2) contains any protection = from legitimate node(s) (as an example DDoS)? In addition, is this type of = attack feasible on IKEv2?=0A=0AThanks.=0A=0A=0A ______________________= _____________________________________=0AYahoo! Answers - Got a question? So= meone out there knows the answer. Try it=0Anow.=0Ahttp://uk.answers.yahoo.c= om/ --0-1727647850-1196136462=:56292 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hi,
=0A
 
=0A
I'm relatively new to IPsec.= I would like to ask regarding the DoS protection in IPsec. Based on the IK= Ev2 standard, there is an anti-clogging mechanism via "cookie" notification= in Notify payload which prevent DoS attack on message echange (i= .e.,phase 1). It seems that the DoS attack is assumed to have or mounted fr= om spoof IP address.
=0A
 
=0A
In that sense, I woul= d like to know whether IPsec (especially the IKEv2) contains any prote= ction from legitimate node(s) (as an example DDoS)? In addition, is th= is type of attack feasible on IKEv2?
=0A
 
=0A
Thank= s.

=0A=0A=0A
=0AFor ideas on reducing you= r carbon footprint visit Yahoo! For Good this month.=0A --0-1727647850-1196136462=:56292-- --===============0321091312== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============0321091312==-- From ipsec-bounces@ietf.org Tue Nov 27 00:01:45 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsZl-0007Uq-PU; Tue, 27 Nov 2007 00:01:37 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwsZk-0007UM-1e for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 00:01:36 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsZi-0007Tx-Gz for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:01:35 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwsZf-0000vc-HT for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:01:34 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1IwsZY-0002i6-AG for ipsec@lists.ietf.org; Tue, 27 Nov 2007 05:01:24 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:01:24 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:01:24 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Tue, 27 Nov 2007 00:01:12 -0500 Lines: 76 Message-ID: References: <18250.58764.542898.587852@fireball.kivinen.iki.fi> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.13pre) Gecko/20070505 Iceape/1.0.9 (Debian-1.0.11~pre071022-0etch1) In-Reply-To: <18250.58764.542898.587852@fireball.kivinen.iki.fi> X-Spam-Score: -0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Cc: Subject: [IPsec] Re: test vectors for IKEv2 SKEYSEED derivation X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Tero Kivinen wrote: > Michael Richardson writes: >> Part A >> The problem is that I didn't know what the key size for MD5 and SHA1 is. >> As far as I knew, it was open --- I can use any key size, since >> HMAC just prepends the key to the data. This for me meant that I should >> have no problems concatenating Ni|Nr > > Depends what HMAC-MD5 / HMAC-SHA1 you talk about. For the > AUTH_HMAC_MD5_96, and AUTH_MHAC_SHA1_96 the RFCs 2403 and 2404 clearly > specify that the input key size is 128 bits and 160 bits, and no other > key lengths are supported. For the PRF_HMAC_MD5 and PRF_HMAC_SHA1 the > RFC2104 does NOT specify the key lenght, but says any key lenght is > acceptable. > >> Part B >> However, in order to know how much keying material to generate, and how much >> is going to be SK_d, SK_ai, SK_ar, I need to know how big each one is going >> to be. For *ESP* the key size of integrity algorithms is MD5,SHA1 = (16 >> bytes, 20 bytes). > > That same applies to the SK_ai, and SK_ar, as they use > AUTH_HMAC_MD5_96 / AUTH_HMAC_SHA1_96. > > The only problem is the SK_d, i.e. how many bytes of keying material > needs to be generated for the SK_d. > >> SK_d is used in prf+ as specified in 2.17. As that is based upon >> prf, I might assume that the "keysize" for prf is like for ESP, i.e. >> 16 and 20 bytes. > > That is what implementations do now, and I think that should be > specified in the future documents. > >> Go back to Part A. If md5 has a 16-byte keysize, then if I provide two >> 16-byte nonces (the smallest allowable), then I should take 8 bytes from Ni, >> and 8 bytes from Nr. Tero's vector clearly didn't do that --- it had 32 >> bytes of input, 16 from each nonce. > > No. > > Even when we have some key size associated with the PRF to specify how > many bytes we need to generate when generating key to be used for the > PRF, that does not make the PRF to require fixed size key. It can > still take variable size of key, thus no truncation is done, and full > Ni and Nr are used. > >> As I am writing this, I am inserting text from RFC4306, such as below: >> >> This concerns RFC4306 sections 2.13/2.14. >> >> 2.13: says: >> >> We assume that each encryption algorithm and integrity protection >> algorithm uses a fixed-size key and that any randomly chosen value of >> that fixed size can serve as an appropriate key. For algorithms that >> accept a variable length key, a fixed key size MUST be specified as >> part of the cryptographic transform negotiated. >> >> I understood this to apply to things like AES. > > It does not apply to AES, which is encryption algorithm. It applies to > the RPF_AES128_XCBC which is PRF function. And note there is some > problems with that already (RFC4434 vs RFC 3664). Well, the statement does apply to encryption algorithms (it says say that), but here, I understand you.. if we negotiated PRF_AES128_XCBC, then are you saying that there would have had to be an attribute of "keysize=128" included? It seems that "128" is included in the name of the PRF? > No. For integrity the key size is fixed by the RFC2403 and RFC2404. > For the PRF the key size is whatever is given to the PRF. The only > thing we should define is the length of the SK_d. okay, so I'm happy, I generate the same vectors are you. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 27 00:05:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsdD-0000AE-HD; Tue, 27 Nov 2007 00:05:11 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwsdC-00005Y-5z for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 00:05:10 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsdB-00005O-Se for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:05:09 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iwsd8-0001GQ-Iy for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:05:09 -0500 Received: from root by ciao.gmane.org with local (Exim 4.43) id 1Iwsd4-000354-Cz for ipsec@lists.ietf.org; Tue, 27 Nov 2007 05:05:02 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:05:02 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:05:02 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Tue, 27 Nov 2007 00:03:53 -0500 Lines: 19 Message-ID: References: <4748ABAF.7020500@sandelman.ca> <18250.57877.627034.798604@fireball.kivinen.iki.fi> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.13pre) Gecko/20070505 Iceape/1.0.9 (Debian-1.0.11~pre071022-0etch1) In-Reply-To: <18250.57877.627034.798604@fireball.kivinen.iki.fi> X-Spam-Score: -0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Cc: Subject: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Tero Kivinen wrote: > Michael Richardson writes: >> Tero, based upon this, is your SKEYSEED input you sent me correct? > > The RFC4306 says that SKEYSEED is generated as: > > SKEYSEED = prf(Ni | Nr, g^ir) > > I.e. the key to the PRF is "Ni | Nr". The only rule that says you > should truncate or modify the key only applies to PRFs which take a > fixed lenght key, but HMAC-MD5 and all other HMACs take variable > length keys, so yes, I think that SKEYSEED key is correct. Paul: I would like this section clarified to include: HMAC-MD5 and HMAC-PRF, when used as a PRF, take variable length keys. (somewhere else, I think you already clarify that they are fixed length when used as INTEG) _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 27 00:10:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsiJ-00052k-CW; Tue, 27 Nov 2007 00:10:27 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwsiI-00052R-4t for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 00:10:26 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsiH-00052B-PW for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:10:25 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwsiE-0001lV-4W for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:10:25 -0500 Received: from root by ciao.gmane.org with local (Exim 4.43) id 1Iwshu-0003rY-3r for ipsec@lists.ietf.org; Tue, 27 Nov 2007 05:10:02 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:10:02 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:10:02 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Tue, 27 Nov 2007 00:09:25 -0500 Lines: 44 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.13pre) Gecko/20070505 Iceape/1.0.9 (Debian-1.0.11~pre071022-0etch1) In-Reply-To: X-Spam-Score: -0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Cc: Subject: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Paul Hoffman wrote: > In Section 2.13, replaced text about variable length keys with > clearer explanation and requirement on non-HMAC PRFs. Also added > "preferred" to Section 2.14 for the key length, and removed redundant > text. > > In Section 2.14, removed the "half and half" description and replaced > it with exceptions for RFC4434 and RFC4615. First, thank you for adding the text: The initiator's signed octets can be described as: InitiatorSignedOctets = RealMessage1 | NonceRData | MACedIDForI GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR RealIKEHDR = SPIi | SPIr | . . . | Length RealMessage1 = RealIKEHDR | RestOfMessage1 NonceRPayload = PayloadHeader | NonceRData InitiatorIDPayload = PayloadHeader | RestOfIDPayload RestOfInitIDPayload = IDType | RESERVED | InitIDData MACedIDForI = prf(SK_pi, RestOfInitIDPayload) I'm pretty sure that "NonceRPayload" is redundant. Why is it shown? Is it just to show what not to include? Is the same reason for including the GENIKEHDR? If that is not the case, then text: Appended to this (for purposes of computing the signature) are the initiator's nonce Ni (just the value, not the payload containing it), and the value Is wrong? Can you order things like this: InitiatorSignedOctets = RealMessage1 | NonceRData | MACedIDForI GenIKEHDR = [ four octets 0 if using port 4500 ] | RealMessage1 RealMessage1 = RealIKEHDR | RestOfMessage1 RealIKEHDR = SPIi | SPIr | . . . | Length InitiatorIDPayload = PayloadHeader | RestOfIDPayload RestOfInitIDPayload = IDType | RESERVED | InitIDData MACedIDForI = prf(SK_pi, RestOfInitIDPayload) I found this clarification much more confusing. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 27 00:16:52 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsoQ-0005jX-LY; Tue, 27 Nov 2007 00:16:46 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwsoP-0005jN-Lt for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 00:16:45 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwsoP-0005jF-CM for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:16:45 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwsoM-0002fi-21 for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:16:45 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1IwsoD-0004yn-8E for ipsec@lists.ietf.org; Tue, 27 Nov 2007 05:16:33 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:16:33 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:16:33 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Tue, 27 Nov 2007 00:16:24 -0500 Lines: 23 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.13pre) Gecko/20070505 Iceape/1.0.9 (Debian-1.0.11~pre071022-0etch1) In-Reply-To: X-Spam-Score: -0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Cc: Subject: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org I'm seeking a clarification on the form of the signatures. Section 2.13 explains what octets to sign. For the shared key case, it is very clear. For the RSA case, I'm a little less clear. RSA signatures are calculated by exponentiating a value. To keep that value short, a hash is actually what is exponentiated. MD5 or SHA1 being the common hashes, with SHA1 being preferred now. I understand that the choice of algorithm is defined by RSASSA-PKCS1-v1_5, with SHA1 preferred, and this is independant of the PRF or INTEGRITY negotiated. The inclusion of the PRF() for the shared key confused me for awhile (only long enough to decide to write this email) into thinking that I needed to sign the PRF() of the message octets. Would sample packets, including the private keys used to generate them be appropriate for an appendix? _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 27 00:24:59 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwswK-0005aN-Ir; Tue, 27 Nov 2007 00:24:56 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwswJ-0005a9-AS for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 00:24:55 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwswJ-0005a0-0y for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:24:55 -0500 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwswF-0003XN-NN for ipsec@lists.ietf.org; Tue, 27 Nov 2007 00:24:55 -0500 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1IwswC-0005wj-CD for ipsec@lists.ietf.org; Tue, 27 Nov 2007 05:24:48 +0000 Received: from wlan197.sandelman.ca ([209.87.252.197]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:24:48 +0000 Received: from mcr by wlan197.sandelman.ca with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 27 Nov 2007 05:24:48 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: ipsec@lists.ietf.org From: Michael Richardson Date: Tue, 27 Nov 2007 00:24:40 -0500 Lines: 13 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: wlan197.sandelman.ca User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.13pre) Gecko/20070505 Iceape/1.0.9 (Debian-1.0.11~pre071022-0etch1) In-Reply-To: X-Spam-Score: -0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Cc: Subject: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org {sorry for lack of editing of reply to Tero. I thought I cut more out} Michael Richardson wrote: > To keep that value short, a hash is actually what is exponentiated. > MD5 or SHA1 being the common hashes, with SHA1 being preferred now. This is, I think, a place where we lack any kind of algorithm agility. I don't know if SHA256 has been standardized anywhere as a hash for use in RSA yet. Or does RFC4231's OID's mean that it could be used? I think that one could include multiple AUTH payloads. If one did, and one include SHA256 OIDs in the signature, would it make sense to actually make this a new AUTH METHOD? _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 27 01:20:15 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwtna-0004H6-RX; Tue, 27 Nov 2007 01:19:58 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IwtnZ-0004Gr-Jv for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 01:19:57 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IwtnZ-0004Gj-AC for ipsec@lists.ietf.org; Tue, 27 Nov 2007 01:19:57 -0500 Received: from smtp.nokia.com ([131.228.20.172] helo=mgw-ext13.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IwtnW-0007Ys-LI for ipsec@lists.ietf.org; Tue, 27 Nov 2007 01:19:57 -0500 Received: from esebh108.NOE.Nokia.com (esebh108.ntc.nokia.com [172.21.143.145]) by mgw-ext13.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id lAR6J945007853; Tue, 27 Nov 2007 08:19:50 +0200 Received: from esebh102.NOE.Nokia.com ([172.21.138.183]) by esebh108.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 27 Nov 2007 08:19:36 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh102.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 27 Nov 2007 08:19:36 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt Date: Tue, 27 Nov 2007 08:19:35 +0200 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt Thread-Index: AcgwszSiY8W8oSIMTX+2DIP0GlRo8QACam6w References: <4748ABAF.7020500@sandelman.ca><18250.57877.627034.798604@fireball.kivinen.iki.fi> From: To: , X-OriginalArrivalTime: 27 Nov 2007 06:19:36.0384 (UTC) FILETIME=[7BC9E400:01C830BD] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Michael Richardson wrote: > Tero Kivinen wrote: > > Michael Richardson writes: > >> Tero, based upon this, is your SKEYSEED input you sent me correct? > >=20 > > The RFC4306 says that SKEYSEED is generated as: > >=20 > > SKEYSEED =3D prf(Ni | Nr, g^ir) > >=20 > > I.e. the key to the PRF is "Ni | Nr". The only rule that says you > > should truncate or modify the key only applies to PRFs which take a > > fixed lenght key, but HMAC-MD5 and all other HMACs take variable > > length keys, so yes, I think that SKEYSEED key is correct.=20 >=20 > Paul: I would like this section clarified to include: > HMAC-MD5 and HMAC-PRF, when used as a PRF, take variable=20 > length keys. >=20 > (somewhere else, I think you already clarify that they are=20 > fixed length when used as INTEG) This is one of the things we did clarify in ikev2bis-02, Section 2.13: It is assumed that pseudo-random functions (PRFs) accept keys of any length, but have a preferred key size. The preferred key size is used as the length of SK_d, SK_pi, and SK_pr (see Section 2.14). For PRFs based on the HMAC construction, the preferred key size is equal to the length of the output of the underlying hash function. Other types of PRFs MUST specify their preferred key size. The text in RFC 4306 which talked about "key is truncated or padded with zeros as necessary" is gone; none of the currently defined PRFs do that. The one exception is documented in Section 2.14: Ni and Nr are the nonces, stripped of any headers. For historical backwards-compatibility reasons, there are two PRFs that are treated specially in this calculation. If the negotiated PRF is AES-XCBC-PRF-128 [RFC4434] or AES-CMAC-PRF-128 [RFC4615], only the first 64 bits of Ni and the first 64 bits of Nr are used in the calculation. Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From ipsec-bounces@ietf.org Tue Nov 27 01:35:40 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwu2k-0001cd-5B; Tue, 27 Nov 2007 01:35:38 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iwu2i-0001cL-9W for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 01:35:36 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iwu2h-0001c6-CV for ipsec@lists.ietf.org; Tue, 27 Nov 2007 01:35:35 -0500 Received: from smtp.nokia.com ([192.100.122.230] helo=mgw-mx03.nokia.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iwu2d-0000Za-Mj for ipsec@lists.ietf.org; Tue, 27 Nov 2007 01:35:35 -0500 Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-mx03.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id lAR6YrmC031253; Tue, 27 Nov 2007 08:35:29 +0200 Received: from esebh104.NOE.Nokia.com ([172.21.143.34]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 27 Nov 2007 08:35:18 +0200 Received: from esebe105.NOE.Nokia.com ([172.21.143.53]) by esebh104.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 27 Nov 2007 08:35:18 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt Date: Tue, 27 Nov 2007 08:35:17 +0200 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt Thread-Index: AcgwtMW+7l3AtWuITB2Iifmo9nqbDwACN5BA References: From: To: , X-OriginalArrivalTime: 27 Nov 2007 06:35:18.0590 (UTC) FILETIME=[AD631DE0:01C830BF] X-Nokia-AV: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Michael Richardson wrote: >=20 > I'm seeking a clarification on the form of the signatures. >=20 > Section 2.13 explains what octets to sign. > For the shared key case, it is very clear. >=20 > For the RSA case, I'm a little less clear. RSA signatures=20 > are calculated by exponentiating a value. To keep that value=20 > short, a hash is actually what is exponentiated. MD5 or SHA1=20 > being the common hashes, with SHA1 being preferred now. The octets-to-be-signed/MAC'd are identical for shared key case and RSA (if you think of RSA as an algorithm which takes the whole=20 message as an input, and computes the hash internally -- this is=20 how RSASSA-PKCS1-v1_5 is described in PKCS#1). > I understand that the choice of algorithm is defined by > RSASSA-PKCS1-v1_5, with SHA1 preferred, and this is=20 > independant of the PRF or INTEGRITY negotiated. Yes, the hash algorithm is independent of the negotiated PRF or INTEGRITY transforms (see RFC 4718, Section 3.2 for more discussion). > The inclusion of the PRF() for the shared key confused me for awhile > (only long enough to decide to write this email) into thinking that > I needed to sign the PRF() of the message octets. Well... even in the RSA case, the signed data *does* include the value prf(SK_pi,IDi') or prf(SK_pr,IDr'). > Would sample packets, including the private keys used to generate=20 > them be appropriate for an appendix? Maybe; are you volunteering to write them? :-) I guess test vectors for SKEYSEED and SK_* calculation wouldn't hurt, either? :-) In separate message, you wrote: > This is, I think, a place where we lack any kind of algorithm > agility. I don't know if SHA256 has been standardized anywhere=20 > as a hash for use in RSA yet. Or does RFC4231's OID's mean that=20 > it could be used? Well, we have *some* kind of algorithm agility; we can move to newer hash functions, but it probably requires manual configuration, and isn't automatically negotiated (like most things in IKEv2). The OIDs for SHA-256/384/512 are standardized in PKCS#1 v2.1.=20 > I think that one could include multiple AUTH payloads. If one did, > and one include SHA256 OIDs in the signature, would it make sense=20 > to actually make this a new AUTH METHOD? Multiple AUTH payloads would be an incompatible extension to=20 RFC4306, meaning IKE v2.1. IMHO new AUTH methods are needed only if we do something else than RSASSA-PKCS1-v1_5. Best regards, Pasi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From myk.Winney@anchorbayvet.com Tue Nov 27 09:26:50 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ix1Ok-00071X-Uf for ipsec-archive@lists.ietf.org; Tue, 27 Nov 2007 09:26:50 -0500 Received: from adsl-ull-78-219.49-151.net24.it ([151.49.219.78]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ix1Ok-0005Uq-Dh for ipsec-archive@lists.ietf.org; Tue, 27 Nov 2007 09:26:50 -0500 Received: from andrea-828b1fb3 ([172.179.42.42]:26886 "EHLO andrea-828b1fb3" smtp-auth: TLS-CIPHER: TLS-PEER-CN1: ) by adsl-ull-78-219.49-151.net24.it with ESMTP id S22RGSIMXWMFHJAX (ORCPT ); Tue, 27 Nov 2007 15:27:19 +0100 Message-ID: <000e01c83101$8cc88920$4edb3197@andrea828b1fb3> From: "myk Winney" To: ipsec-archive@lists.ietf.org Subject: smargorp Date: Tue, 27 Nov 2007 15:26:50 +0100 Message-ID: <000e01c83101$8cc88920$4edb3197@andrea828b1fb3> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.6626 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 4.7 (++++) X-Scan-Signature: 0f1ff0b0158b41ac6b9548d0972cdd31 once you wear one of these, you'll never look back http://aapalmer.com/ From ipsec-bounces@ietf.org Tue Nov 27 09:30:39 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ix1SC-000176-Ro; Tue, 27 Nov 2007 09:30:24 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ix1SB-00011i-Ts for ipsec-confirm+ok@megatron.ietf.org; Tue, 27 Nov 2007 09:30:23 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ix1SB-00011Z-KH for ipsec@lists.ietf.org; Tue, 27 Nov 2007 09:30:23 -0500 Received: from [2001:1bc8:100d::2] (helo=mail.kivinen.iki.fi) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ix1SB-0003cj-5K for ipsec@lists.ietf.org; Tue, 27 Nov 2007 09:30:23 -0500 Received: from fireball.kivinen.iki.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.13.8/8.12.10) with ESMTP id lAREULX0023386 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 27 Nov 2007 16:30:21 +0200 (EET) Received: (from kivinen@localhost) by fireball.kivinen.iki.fi (8.13.8/8.12.11) id lAREUJ3A002809; Tue, 27 Nov 2007 16:30:19 +0200 (EET) X-Authentication-Warning: fireball.kivinen.iki.fi: kivinen set sender to kivinen@iki.fi using -f MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18252.10747.455107.780676@fireball.kivinen.iki.fi> Date: Tue, 27 Nov 2007 16:30:19 +0200 From: Tero Kivinen To: Michael Richardson Subject: [IPsec] Re: test vectors for IKEv2 SKEYSEED derivation In-Reply-To: References: <18250.58764.542898.587852@fireball.kivinen.iki.fi> X-Mailer: VM 7.19 under Emacs 21.4.1 X-Edit-Time: 9 min X-Total-Time: 9 min X-Spam-Score: -1.4 (-) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Cc: ipsec@lists.ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Michael Richardson writes: > Well, the statement does apply to encryption algorithms (it says say that), > but here, I understand you.. Oh, sorry, I didn't check the where you cut & pasted that text, I assumed it was from 2.14 i.e. about SKEYSEED generation, but that was from 2.13 i.e. from generating key material. So that text applies to all of the things generated out from the SKEYSEED, i.e SK_d, SK_ai, SK_ar, SK_ei, SK_er, SK_pi, and SK_pr. > if we negotiated PRF_AES128_XCBC, then are you > saying that there would have had to be an attribute of "keysize=128" > included? It seems that "128" is included in the name of the PRF? No, we do not need keysize (and cannot have it) in that case, as the PRF_AES128_XCBC is fixed key length algorith, that only accepts keys of length of 128 bits, as defined in the section 4.1 of the RFC 3566 referenced from the section 2 of the RFC 3664 referenced from section 3.3.2 transform type 2 table of the RFC 4306. Note, that it is not whether the underlaying algorithm can accept variable length keys, it is whether the algorithm used in the IKE can be used with variable lenght keys. -- kivinen@safenet-inc.com _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From MandyquarterbackThomson@tuaw.com Tue Nov 27 17:58:09 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ix9NZ-0000gw-7M; Tue, 27 Nov 2007 17:58:09 -0500 Received: from [190.8.155.154] (helo=dollyafdb2fe86) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ix9NY-00032E-Go; Tue, 27 Nov 2007 17:58:09 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host72526796.tuaw.com (8.13.1/8.13.1) with SMTP id 9ntZuSVb06.943124.fUe.Glf.4622781571435 for ; Tue, 27 Nov 2007 17:57:38 +0500 Message-ID: <1c3001c83148$f4212b80$1701a8c0@dollyafdb2fe86> From: "May Feliciano" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_1C2C_01C83148.F4212B80-- From PhiliplockstepWashington@annapolis.net Tue Nov 27 23:02:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxE7f-0002PR-Nc; Tue, 27 Nov 2007 23:02:04 -0500 Received: from pool-71-184-214-202.bstnma.fios.verizon.net ([71.184.214.202] helo=family.home) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IxE7f-0007DX-6U; Tue, 27 Nov 2007 23:02:03 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host88943920.annapolis.net (8.13.1/8.13.1) with SMTP id XPTOWuFu86.023619.0k4.7zo.7389572955367 for ; Tue, 27 Nov 2007 23:01:51 +0500 Message-ID: <22ebd01c83173$6ee9b830$0301a8c0@FAMILY> From: "Ernest Henderson" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_22EB9_01C83173.6EE9B830-- From ipsec-bounces@ietf.org Wed Nov 28 07:05:48 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxLfI-0007jM-Ff; Wed, 28 Nov 2007 07:05:16 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IxLfG-0007iz-NJ for ipsec-confirm+ok@megatron.ietf.org; Wed, 28 Nov 2007 07:05:14 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxLfG-0007ip-AV for ipsec@ietf.org; Wed, 28 Nov 2007 07:05:14 -0500 Received: from datnt07.tieto.com ([194.110.47.24] helo=tietoe03.tietoenator.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IxLfD-0002Tr-W7 for ipsec@ietf.org; Wed, 28 Nov 2007 07:05:14 -0500 X-AuditID: c26e2f18-0000225c00001cfc-d7-474d5964361f Received: from camaro.eu.tieto.com ([192.176.143.43]) by tietoe03.tietoenator.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 28 Nov 2007 14:04:52 +0200 Received: from corvette.eu.tieto.com ([192.176.143.143]) by camaro.eu.tieto.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 28 Nov 2007 13:05:09 +0100 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [IPsec] Use of SPD in verifying incoming packets Date: Wed, 28 Nov 2007 13:05:07 +0100 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [IPsec] Use of SPD in verifying incoming packets Thread-Index: AcgjH/jxoNzqGx0nSGugEheSKZb2nAOls+QA References: <1194632232.2477.636.camel@faith.austin.ibm.com><20071109183409.GB3152@kebe.East.Sun.COM><1194639081.2477.659.camel@faith.austin.ibm.com> From: To: X-OriginalArrivalTime: 28 Nov 2007 12:05:09.0772 (UTC) FILETIME=[EC4394C0:01C831B6] X-Brightmail-Tracker: AAAAAA== X-Spam-Score: -4.0 (----) X-Scan-Signature: 850245b51c39701e2700a112f3032caa X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0259346706==" Errors-To: ipsec-bounces@ietf.org This is a multi-part message in MIME format. --===============0259346706== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C831B6.EB289692" This is a multi-part message in MIME format. ------_=_NextPart_001_01C831B6.EB289692 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, =20 The text in RFC4301 page 24-26 regarding IKE negotiation is not clear to me. It says "For example, suppose one starts with an entry A (from an ordered SPD) that when decorrelated, yields entries A1, A2, and A3. When a packet comes along that matches, say A2, and triggers the creation of an SA, the SA management protocol (e.g., IKEv2) negotiates A." ... "Alternatively, the original entry from the (correlated) SPD may be retained and passed to the SA management protocol." I read this as IKE is allowed as an initiator to propose A in a negotiation. =20 However RFC4718 page 21 (section 4.12): "the initiator should not propose traffic selectors that violate its own policy. If this rule is not followed, valid traffic may be dropped." =20 Is RFC4718 overruling RFC4301 on this point ? Saying that A should never be proposed, but "only" A1, A2, A3 proposed. =20 If this is the case then I understand that inbound traffic arriving on an SA need only be validated against the SA and need not be verified against the access control policy expressed in the (ordered) SPD. =20 Regards Inger Bohlbro ________________________________ From: Stephen Kent [mailto:kent@bbn.com]=20 Sent: 9. november 2007 23:29 To: Joy Latten Cc: ipsec@ietf.org; Dan McDonald Subject: Re: [IPsec] Use of SPD in verifying incoming packets Joy, The inbound processing diagram (Figue 3) shows how to process traffic in the context of a decorrelated SPD. That is a major improvement that we made in going from 2401 to 4301. For traffic not protected by IPsec, there is an SPD-I cache that either allows traffic to bypass IPsec, or discards the traffic. For traffic that arrives via an SA, the diagram shows an SAD check in the lower right corner. That check replaces the SPD search that was described in 2301. Step 4 of the inbound processing description calls for IPsec traffic to be checked against the SAD entry for the SA via which the traffic was processed. The traffic selectors here should be the ones negotiated for the SA, whether the SPD was de-correlated or not. I fear the text you cited on page 25-26 (not 24-25) is in error. If one looks at the whole paragraph is says: In all cases, when a decorrelated SPD is available, the decorrelated entries are used to populate the SPD-S cache. If the SPD is not decorrelated, caching is not allowed and an ordered search of SPD MUST be performed to verify that inbound traffic arriving on an SA is consistent with the access control policy expressed in the SPD. Note that his text refers to the SPD-S cache, a cache that is used only for outbound traffic, not inbound traffic. So the last sentence is a carryover from the old, 2401 inbound processing description, which we know to be deficient. Sorry 'bout that. Steve ------_=_NextPart_001_01C831B6.EB289692 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Re: [IPsec] Use of SPD in verifying incoming = packets
Hi,
 
The text in RFC4301 page 24-26 regarding IKE=20 negotiation is not clear to me. It says
      "For example, = suppose=20 one starts
      with an entry A (from an = ordered=20 SPD) that when decorrelated,
      yields = entries=20 A1, A2, and A3.  When a packet comes along=20 that
      matches, say A2, and triggers the = creation of an SA, the SA
      management = protocol=20 (e.g., IKEv2) negotiates A."  ...
      = "Alternatively, the=20 original entry from the (correlated) SPD may=20 be
      retained and passed to the SA = management=20 protocol."
I read this as IKE is allowed as an initiator = to=20 propose A in a negotiation.
 
However RFC4718 page 21 (section=20 4.12):
      "the initiator = should=20 not propose traffic selectors that violate its own policy. If this rule = is not=20 followed, valid traffic may be dropped."
 
Is RFC4718 overruling RFC4301 on this point ? = Saying=20 that A should never be proposed, but "only" A1, A2, A3=20 proposed.
 
If this is the case then I understand that = inbound=20 traffic arriving on an SA need only be validated against the SA and need = not be=20 verified against the access control policy expressed in the (ordered)=20 SPD.
 
Regards
Inger = Bohlbro

From: Stephen Kent = [mailto:kent@bbn.com]=20
Sent: 9. november 2007 23:29
To: Joy = Latten
Cc:=20 ipsec@ietf.org; Dan McDonald
Subject: Re: [IPsec] Use of SPD = in=20 verifying incoming packets

Joy,

The inbound processing diagram (Figue 3) shows how to process = traffic in=20 the context of a decorrelated SPD. That is a major improvement that we = made in=20 going from 2401 to 4301.  For traffic not protected by IPsec, there = is an=20 SPD-I cache that either allows traffic to bypass IPsec, or discards the = traffic.=20 For traffic that arrives via an SA, the diagram shows an SAD check in = the lower=20 right corner. That check replaces the SPD search that was described in = 2301.=20 Step 4 of the inbound processing description calls for IPsec traffic to = be=20 checked against the SAD entry for the SA via which the traffic was = processed.=20 The traffic selectors here should be the ones negotiated for the SA, = whether the=20 SPD was de-correlated or not.

I fear the text you cited on page 25-26 (not 24-25) is in = error.  If=20 one looks at the whole paragraph is says:

In all cases, when a = decorrelated=20 SPD is available, the decorrelated entries are used to populate the = SPD-S=20 cache.  If the SPD is not decorrelated, caching is not allowed and = an=20 ordered search of SPD MUST be performed to verify that inbound traffic = arriving=20 on an SA is consistent with the access control policy expressed in the=20 SPD.

Note that his text refers to the SPD-S cache, a cache that is used = only for=20 outbound traffic, not inbound traffic. So the last sentence is a = carryover from=20 the old, 2401 inbound processing description, which we know to be=20 deficient.

Sorry 'bout that.

Steve
------_=_NextPart_001_01C831B6.EB289692-- --===============0259346706== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============0259346706==-- From ipsec-bounces@ietf.org Wed Nov 28 08:53:38 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxNLx-000567-EG; Wed, 28 Nov 2007 08:53:25 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IxNLt-000555-NZ for ipsec-confirm+ok@megatron.ietf.org; Wed, 28 Nov 2007 08:53:21 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxNLr-00051E-FS for ipsec@ietf.org; Wed, 28 Nov 2007 08:53:19 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IxNLo-0002yO-IS for ipsec@ietf.org; Wed, 28 Nov 2007 08:53:19 -0500 Received: from MBP.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lASDrHoC009552; Wed, 28 Nov 2007 15:53:17 +0200 (IST) Message-Id: From: Yoav Nir To: "Hisyam F." , ipsec@ietf.org In-Reply-To: <657692.56292.qm@web26604.mail.ukl.yahoo.com> Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [IPsec] IKEv2 - possible attack from legitimate node(s)? Date: Wed, 28 Nov 2007 15:53:14 +0200 References: <657692.56292.qm@web26604.mail.ukl.yahoo.com> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: 67c1ea29f88502ef6a32ccec927970f0 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1871920357==" Errors-To: ipsec-bounces@ietf.org --===============1871920357== Content-Type: multipart/alternative; boundary=Apple-Mail-24-1054946260 --Apple-Mail-24-1054946260 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Hi Hisyam. An attack like this is very feasible, and the IKEv2 protocol does not have any protection against it. Individual implementations could have some protections, such as limiting the amount of half-open SAs from a particular IP address, or limiting the amount of IKE SAs from a particular peer. Years ago, there were some proposals for securing against a DoS attack by, for example replacing the cookie with a hash of the cookie and a partial pre-image (say, all the cookie save the last 32 bits). This would force the client to brute-force the cookie (taking on average 2^31 hash operations), by levying a 1-CPU-second "tax" on each connecting client. This proposal died, I think because of all kinds of patents surrounding such technology. On Nov 27, 2007, at 6:07 AM, Hisyam F. wrote: > Hi, > > I'm relatively new to IPsec. I would like to ask regarding the DoS > protection in IPsec. Based on the IKEv2 standard, there is an anti- > clogging mechanism via "cookie" notification in Notify payload which > prevent DoS attack on message echange (i.e.,phase 1). It seems that > the DoS attack is assumed to have or mounted from spoof IP address. > > In that sense, I would like to know whether IPsec (especially the > IKEv2) contains any protection from legitimate node(s) (as an > example DDoS)? In addition, is this type of attack feasible on IKEv2? > > Thanks. > > For ideas on reducing your carbon footprint visit Yahoo! For Good > this month. > > Scanned by Check Point Total Security Gateway. > > _______________________________________________ > IPsec mailing list > IPsec@ietf.org > https://www1.ietf.org/mailman/listinfo/ipsec --Apple-Mail-24-1054946260 Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Hi Hisyam.

An attack like this is = very feasible, and the IKEv2 protocol does not have any protection = against it. Individual implementations could have some protections, such = as limiting the amount of half-open SAs from a particular IP address, or = limiting the amount of IKE SAs from a particular peer.

Years ago, there were some = proposals for securing against a DoS attack by, for example replacing = the cookie with a hash of the cookie and a partial pre-image (say, all = the cookie save the last 32 bits).  This would force the client to = brute-force the cookie (taking on average 2^31 hash operations), by = levying a 1-CPU-second "tax" on each connecting client.  This = proposal died, I think because of all kinds of patents surrounding such = technology.


On Nov 27, = 2007, at 6:07 AM, Hisyam F. wrote:

Hi,
I'm relatively new to IPsec. I = would like to ask regarding the DoS protection in IPsec. Based on the = IKEv2 standard, there is an anti-clogging mechanism via "cookie" = notification in Notify payload which prevent DoS attack = on message echange (i.e.,phase 1). It seems that the DoS attack is = assumed to have or mounted from spoof IP address.
 
In that = sense, I would like to know whether IPsec (especially the IKEv2) = contains any protection from legitimate node(s) (as an example = DDoS)? In addition, is this type of attack feasible on IKEv2?
 
For ideas on reducing your = carbon footprint visit Yahoo! = For Good this = month. 

Scanned = by Check Point Total Security Gateway. 

_____________________= __________________________
IPsec mailing list
IPsec@ietf.org
https://www1.ietf.or= g/mailman/listinfo/ipsec

= = --Apple-Mail-24-1054946260-- --===============1871920357== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============1871920357==-- From Kum@IBERPASS.COM Wed Nov 28 12:38:05 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxQrN-0006Mr-8d for ipsec-archive@lists.ietf.org; Wed, 28 Nov 2007 12:38:05 -0500 Received: from chello083144094197.chello.pl ([83.144.94.197]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IxQrM-0005X6-ON for ipsec-archive@lists.ietf.org; Wed, 28 Nov 2007 12:38:05 -0500 Received: from miro by IBERPASS.COM with ASMTP id B06B9427 for ; Wed, 28 Nov 2007 18:38:15 +0100 Received: from miro ([185.160.83.151]) by IBERPASS.COM with ESMTP id F7E28C619925 for ; Wed, 28 Nov 2007 18:38:15 +0100 Message-ID: <000501c831e5$6d5fdd10$c55e9053@miro> From: "Kum soydemir" To: Subject: neimaado Date: Wed, 28 Nov 2007 18:38:03 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C831ED.CF244510" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 2.0 (++) X-Scan-Signature: 93238566e09e6e262849b4f805833007 ------=_NextPart_000_0004_01C831ED.CF244510 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable COMPLETE VIRILITY formula for men http://www.elimtab.com/ ------=_NextPart_000_0004_01C831ED.CF244510 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable
COMPLETE VIRILITY formula for men http://www.elimtab.com/
------=_NextPart_000_0004_01C831ED.CF244510-- From MariettacockyBabb@newsweek.com Wed Nov 28 14:10:14 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxSIX-0005Dc-3P; Wed, 28 Nov 2007 14:10:13 -0500 Received: from [200.113.140.195] (helo=ventas) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IxSIW-0007AE-Bu; Wed, 28 Nov 2007 14:10:13 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host92708128.newsweek.com (8.13.1/8.13.1) with SMTP id WrfVTrmP01.179883.eqU.H3V.3897501217704 for ; Wed, 28 Nov 2007 16:09:55 +0400 Message-ID: <7cb601c831f2$4c221d90$9a00a8c0@Ventas> From: "Marva Denny" To: Subject: Approval process Date: Wed, 28 Nov 2007 16:09:55 +0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_7CB2_01C831F2.4C221D90" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_7CB2_01C831F2.4C221D90 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_7CB2_01C831F2.4C221D90 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_7CB2_01C831F2.4C221D90-- From pwjtribunal@fax.net Wed Nov 28 15:34:09 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxTbk-0007ST-RO; Wed, 28 Nov 2007 15:34:08 -0500 Received: from [88.254.177.22] (helo=fax.net) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1IxTbj-0001Ik-Sk; Wed, 28 Nov 2007 15:34:08 -0500 Received: (qmail 675 invoked from network); Wed, 28 Nov 2007 22:34:08 +0200 Received: from unknown (HELO admin) (pwjtribunal@fax.net@97.124.196.78) by 16b1fe58fax.net with SMTP; Wed, 28 Nov 2007 22:34:08 +0200 Message-ID: <001001c8320e$ca0e87e0$075bed74@admin> From: Claudio Forbes To: imapext-archive@lists.ietf.org Subject: As enthusiasm Date: Wed, 28 Nov 2007 22:34:08 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000D_01C8320E.CA0E87E0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.181 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.4682 X-Spam-Score: 0.5 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 This is a multi-part message in MIME format. ------=_NextPart_000_000D_01C8320E.CA0E87E0 Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable program's of navigating, interacting with various tools, objects, case arti= sts will lose their authenticity, however, due to Presently, native art is internationally recognized and cherished ------=_NextPart_000_000D_01C8320E.CA0E87E0 Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable

keys while technology does most of our thinking. Its as if we're

Are you wanting a bi ,gger pen ,is?

As seen on TV

Over 700,000 Men around the world are already satis ,fied
G ,ain 4+ Inches In Le,ngth
Inc ,rease Your Pen, is Wid ,th (Gi ,rth) By u,p-to 23%
100% Sa,fe To Take, With NO S:ide Effects
No P, umps! No Surgery! No Exercises!

lipercon. com /* O, mit Empty Space

their industry, replication is rampant, to a certain degree, and
= ------=_NextPart_000_000D_01C8320E.CA0E87E0-- From ipsec-bounces@ietf.org Wed Nov 28 17:54:55 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxVnj-0001vO-AC; Wed, 28 Nov 2007 17:54:39 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IxVni-0001vH-Ci for ipsec-confirm+ok@megatron.ietf.org; Wed, 28 Nov 2007 17:54:38 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxVni-0001v6-3H for ipsec@ietf.org; Wed, 28 Nov 2007 17:54:38 -0500 Received: from web26612.mail.ukl.yahoo.com ([217.146.177.64]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1IxVnh-00087T-2k for ipsec@ietf.org; Wed, 28 Nov 2007 17:54:38 -0500 Received: (qmail 13536 invoked by uid 60001); 28 Nov 2007 22:54:36 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Message-ID; b=CR1PgHHzKcUNlwu+XOD+mW6bGbA+1jrvehYEEXG5BzsPlM/bTy/1117RGngcZPFyeIuTL+Pa0rJvihZ8/J3OklN16AH5fx019AM9PHYvubR58XLAHJICVY3JO+0bNXfv7bOu/dbyt/8yEky4/HrDrKlZHIcy7Vuo7eGdfPJK8cE=; X-YMail-OSG: GSkmqVEVM1kP6VF3jcehERSLSbPxP5IwoY3nE6QId__611T7SAjSXic.M_ySz4yRT2waZsg9_weY8fLPkF.45xBi.dClz0SCtaLFzU9nkVwzkmCIqFyFzMOqgpI- Received: from [129.78.64.101] by web26612.mail.ukl.yahoo.com via HTTP; Wed, 28 Nov 2007 22:54:36 GMT X-Mailer: YahooMailRC/818.27 YahooMailWebService/0.7.157 Date: Wed, 28 Nov 2007 22:54:36 +0000 (GMT) From: "Hisyam F." Subject: Re: [IPsec] IKEv2 - possible attack from legitimate node(s)? To: Yoav Nir , ipsec@ietf.org MIME-Version: 1.0 Message-ID: <473403.13247.qm@web26612.mail.ukl.yahoo.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: ff03b0075c3fc728d7d60a15b4ee1ad2 Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1359080583==" Errors-To: ipsec-bounces@ietf.org --===============1359080583== Content-Type: multipart/alternative; boundary="0-784728744-1196290476=:13247" --0-784728744-1196290476=:13247 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Yoav,=0A=0AThanks for the reply. Since the attack from legitimate node(s= ) is feasible, I agree on your statement that each individual (recepient) s= hould implements defensive mechanism against such attack.=0A=0ANevertheless= , I would like to ask your opinion regarding the IKEv2 message exchange. As= stated in your previous reply, there were several works have been done in = combating DoS i.e., HASH cookie mechanism etc. It seems that in order to de= feat DoS attack, each technique in literature suggests the initiator to aut= henticate him/herself (prove the identity) to the respective responder by r= eturning the correct cookie. However, I think that this verification method= is efficient to certain degrees subject to the assumption that an attack i= s mounted from malicious attacker with spoofed ID. Since this is not applic= able to DDoS as each nodes can have legitimate ID, does it means it is imp= ossible (I hope not) for us to propose a better approach for IKEv2? =0A= =0A=0A----- Original Message ----=0AFrom: Yoav Nir =0A= To: Hisyam F. ; ipsec@ietf.org=0ASent: Thursday, 29 N= ovember, 2007 12:53:14 AM=0ASubject: Re: [IPsec] IKEv2 - possible attack fr= om legitimate node(s)?=0A=0AHi Hisyam.=0A=0A=0AAn attack like this is very = feasible, and the IKEv2 protocol does not have any protection against it. I= ndividual implementations could have some protections, such as limiting the= amount of half-open SAs from a particular IP address, or limiting the amou= nt of IKE SAs from a particular peer.=0A=0A=0AYears ago, there were some pr= oposals for securing against a DoS attack by, for example replacing the coo= kie with a hash of the cookie and a partial pre-image (say, all the cookie = save the last 32 bits). This would force the client to brute-force the coo= kie (taking on average 2^31 hash operations), by levying a 1-CPU-second "ta= x" on each connecting client. This proposal died, I think because of all k= inds of patents surrounding such technology.=0A=0A=0A=0A=0AOn Nov 27, 2007,= at 6:07 AM, Hisyam F. wrote:=0A=0A=0AHi,=0A =0AI'm relatively new to IPsec= . I would like to ask regarding the DoS protection in IPsec. Based on the I= KEv2 standard, there is an anti-clogging mechanism via "cookie" notificatio= n in Notify payload which prevent DoS attack on message echange (i.e.,phase= 1). It seems that the DoS attack is assumed to have or mounted from spoof = IP address.=0A =0AIn that sense, I would like to know whether IPsec (especi= ally the IKEv2) contains any protection from legitimate node(s) (as an exam= ple DDoS)? In addition, is this type of attack feasible on IKEv2?=0A =0ATha= nks.=0A=0A=0A=0AFor ideas on reducing your carbon footprint visit Yahoo! Fo= r Good this month. =0A=0AScanned by Check Point Total Security Gateway. =0A= =0A_______________________________________________=0AIPsec mailing list=0AI= Psec@ietf.org=0Ahttps://www1.ietf.org/mailman/listinfo/ipsec=0A=0A=0A = ___________________________________________________________ =0AWant ideas f= or reducing your carbon footprint? Visit Yahoo! For Good http://uk.promoti= ons.yahoo.com/forgood/environment.html --0-784728744-1196290476=:13247 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hi Yoav,
=0A
 
=0A
Thanks for the reply. Since the attack fr= om legitimate node(s) is feasible, I agree on your statement that each= individual (recepient) should implements defensive mechanism against such = attack.
=0A
 
=0A
Nevertheless, I would like to ask your op= inion regarding the IKEv2 message exchange. As stated in your previous= reply, there were several works have been done in combating DoS i.e., = ;HASH cookie mechanism etc. It seems that in order to defeat DoS attac= k, each technique in literature suggests the initiator to authenticate him/= herself (prove the identity) to the respective responder by returning the c= orrect cookie. However, I think that this verification method is = efficient to certain degrees subject to the assumption that an attack&= nbsp;is mounted from malicious attacker with spoofed ID. Since this is not = applicable to DDoS  as each nodes can have legitimate ID, does it mean= s it is impossible (I hope not) for us to propose a better approa= ch for IKEv2?     

=0A
= ----- Original Message ----
From: Yoav Nir <ynir@checkpoint.com>To: Hisyam F. <f_hisyam@yahoo.co.uk>; ipsec@ietf.org
Sent: Thurs= day, 29 November, 2007 12:53:14 AM
Subject: Re: [IPsec] IKEv2 - possible= attack from legitimate node(s)?

Hi Hisyam.=0A

=0A
An attack like this is very feasible, and= the IKEv2 protocol does not have any protection against it. Individual imp= lementations could have some protections, such as limiting the amount of ha= lf-open SAs from a particular IP address, or limiting the amount of IKE SAs= from a particular peer.
=0A

=
=0A
Years ago, there were some proposals for securing against a D= oS attack by, for example replacing the cookie with a hash of the cookie an= d a partial pre-image (say, all the cookie save the last 32 bits).  Th= is would force the client to brute-force the cookie (taking on average 2^31= hash operations), by levying a 1-CPU-second "tax" on each connecting clien= t.  This proposal died, I think because of all kinds of patents surrou= nding such technology.
=0A

=0A

=0A
=0A
On Nov 27, 2007, at 6:07 AM, Hisyam F. wrot= e:

=0A
= =0A
=0A
=0A
Hi,
=0A 
=0A
I'm relati= vely new to IPsec. I would like to ask regarding the DoS protection in IPse= c. Based on the IKEv2 standard, there is an anti-clogging mechanism via "co= okie" notification in Notify payload which prevent DoS attack on = message echange (i.e.,phase 1). It seems that the DoS attack is assumed to = have or mounted from spoof IP address.
=0A
&= nbsp;
=0A
In that sense, I would like to kno= w whether IPsec (especially the IKEv2) contains any protection from&nb= sp;legitimate node(s) (as an example DDoS)? In addition, is this type of at= tack feasible on IKEv2?
=0A
 
=0A<= DIV style=3D"MARGIN: 0px">Thanks.

=0A
=0AFor ide= as on reducing your carbon footprint visit Yahoo! For Good this month. 

Scanned by Check Point Total Security Gateway. 

_____________________= __________________________
IPsec mailing list
IPsec@ietf.org
https://www1.ietf.org/mailman/listinfo/= ipsec

=0A

<= /div>
=0A=0A=0A
=0AFor ideas on reducing your carbon = footprint visit Yahoo! For Good this month.=0A --0-784728744-1196290476=:13247-- --===============1359080583== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============1359080583==-- From BradfordmalignantMorton@aaaknow.com Wed Nov 28 18:54:22 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxWjV-0002O5-IV; Wed, 28 Nov 2007 18:54:21 -0500 Received: from [200.59.10.58] (helo=edgardo.cotelcam.com.ar) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1IxWjT-0001pr-UM; Wed, 28 Nov 2007 18:54:21 -0500 Received: from flathead by aaaknow.com with SMTP id A7XmgmGkU3 for ; Wed, 28 Nov 2007 20:56:53 +0300 From: "Darrin Figueroa" To: ion-archive@lists.ietf.org Subject: Best offer in gambling history . Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 0f1ff0b0158b41ac6b9548d0972cdd31 hi From DonnafurmanOconnell@deccanherald.com Wed Nov 28 23:22:04 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxauZ-0001hM-Lp; Wed, 28 Nov 2007 23:22:04 -0500 Received: from pool-141-158-229-62.phil.east.verizon.net ([141.158.229.62] helo=lohn0c3t52x7cq.myhome.westell.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IxauZ-0000VX-32; Wed, 28 Nov 2007 23:22:03 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host25177033.deccanherald.com (8.13.1/8.13.1) with SMTP id ZGMrplxR98.937169.Lmq.0fT.4329055422656 for ; Wed, 28 Nov 2007 23:21:46 +0500 Message-ID: <91ccd01c8323f$61fbcec0$2f01a8c0@lohn0c3t52x7cq> From: "Donna Hanna" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_91CC9_01C8323F.61FBCEC0-- From ipsec-bounces@ietf.org Thu Nov 29 02:33:14 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxdtK-000864-0P; Thu, 29 Nov 2007 02:32:58 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IxdtJ-000846-Bd for ipsec-confirm+ok@megatron.ietf.org; Thu, 29 Nov 2007 02:32:57 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxdtI-0007z5-Te for ipsec@ietf.org; Thu, 29 Nov 2007 02:32:56 -0500 Received: from michael.checkpoint.com ([194.29.32.68]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IxdtH-0000tU-9z for ipsec@ietf.org; Thu, 29 Nov 2007 02:32:56 -0500 Received: from MBP.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id lAT7WtoC006592; Thu, 29 Nov 2007 09:32:55 +0200 (IST) Message-Id: <69AEBECB-A819-4B72-9BF9-36A7A5BF068F@checkpoint.com> From: Yoav Nir To: "Hisyam F." , ipsec@ietf.org In-Reply-To: <473403.13247.qm@web26612.mail.ukl.yahoo.com> Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [IPsec] IKEv2 - possible attack from legitimate node(s)? Date: Thu, 29 Nov 2007 09:32:51 +0200 References: <473403.13247.qm@web26612.mail.ukl.yahoo.com> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: f0b5a4216bfa030ed8a6f68d1833f8ae Cc: X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0867533752==" Errors-To: ipsec-bounces@ietf.org --===============0867533752== Content-Type: multipart/alternative; boundary=Apple-Mail-7--1028960856 --Apple-Mail-7--1028960856 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit The cookie mechanism is far from useless. Given a fixed amount of "attacking resources", you can mount a far greater volume of spoofed- IP attacks than you can legitimate IP address attacks. Enforcing a return IP address also makes features like "only 3 half-open SAs from a single IP address" more feasible. I think hash cookies are the best way to get something that scales well enough to defeat DDoS attacks. On Nov 29, 2007, at 12:54 AM, Hisyam F. wrote: > Hi Yoav, > > Thanks for the reply. Since the attack from legitimate node(s) is > feasible, I agree on your statement that each individual (recepient) > should implements defensive mechanism against such attack. > > Nevertheless, I would like to ask your opinion regarding the IKEv2 > message exchange. As stated in your previous reply, there were > several works have been done in combating DoS i.e., HASH cookie > mechanism etc. It seems that in order to defeat DoS attack, each > technique in literature suggests the initiator to authenticate him/ > herself (prove the identity) to the respective responder by > returning the correct cookie. However, I think that this > verification method is efficient to certain degrees subject to the > assumption that an attack is mounted from malicious attacker with > spoofed ID. Since this is not applicable to DDoS as each nodes can > have legitimate ID, does it means it is impossible (I hope not) for > us to propose a better approach for IKEv2? > > ----- Original Message ---- > From: Yoav Nir > To: Hisyam F. ; ipsec@ietf.org > Sent: Thursday, 29 November, 2007 12:53:14 AM > Subject: Re: [IPsec] IKEv2 - possible attack from legitimate node(s)? > > Hi Hisyam. > > An attack like this is very feasible, and the IKEv2 protocol does > not have any protection against it. Individual implementations could > have some protections, such as limiting the amount of half-open SAs > from a particular IP address, or limiting the amount of IKE SAs from > a particular peer. > > Years ago, there were some proposals for securing against a DoS > attack by, for example replacing the cookie with a hash of the > cookie and a partial pre-image (say, all the cookie save the last 32 > bits). This would force the client to brute-force the cookie > (taking on average 2^31 hash operations), by levying a 1-CPU-second > "tax" on each connecting client. This proposal died, I think > because of all kinds of patents surrounding such technology. > > > On Nov 27, 2007, at 6:07 AM, Hisyam F. wrote: > >> Hi, >> >> I'm relatively new to IPsec. I would like to ask regarding the DoS >> protection in IPsec. Based on the IKEv2 standard, there is an anti- >> clogging mechanism via "cookie" notification in Notify payload >> which prevent DoS attack on message echange (i.e.,phase 1). It >> seems that the DoS attack is assumed to have or mounted from spoof >> IP address. >> >> In that sense, I would like to know whether IPsec (especially the >> IKEv2) contains any protection from legitimate node(s) (as an >> example DDoS)? In addition, is this type of attack feasible on IKEv2? >> >> Thanks. >> >> For ideas on reducing your carbon footprint visit Yahoo! For Good >> this month. >> >> Scanned by Check Point Total Security Gateway. >> >> _______________________________________________ >> IPsec mailing list >> IPsec@ietf.org >> https://www1.ietf.org/mailman/listinfo/ipsec > > > > For ideas on reducing your carbon footprint visit Yahoo! For Good > this month. > > Scanned by Check Point Total Security Gateway. > --Apple-Mail-7--1028960856 Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: quoted-printable The cookie mechanism is far = from useless.  Given a fixed amount of "attacking resources", you = can mount a far greater volume of spoofed-IP attacks than you can = legitimate IP address attacks.  Enforcing a return IP address also = makes features like "only 3 half-open SAs from a single IP address" more = feasible.

I think hash cookies are = the best way to get something that scales well enough to defeat DDoS = attacks.


On Nov 29, = 2007, at 12:54 AM, Hisyam F. wrote:

Hi Yoav,
 
Thanks for the reply. Since the attack from legitimate node(s) is = feasible, I agree on your statement that each individual = (recepient) should implements defensive mechanism against such = attack.
 
Nevertheless, I would like to ask your opinion regarding the = IKEv2 message exchange. As stated in your previous reply, there = were several works have been done in combating DoS i.e., HASH = cookie mechanism etc. It seems that in order to defeat DoS attack, = each technique in literature suggests the initiator to authenticate = him/herself (prove the identity) to the respective responder by = returning the correct cookie. However, I think that this verification = method is efficient to certain degrees subject to the = assumption that an attack is mounted from malicious attacker = with spoofed ID. Since this is not applicable to DDoS  as each = nodes can have legitimate ID, does it means it is impossible (I = hope not) for us to propose a better approach for = IKEv2?     

----- Original Message ----
From: Yoav Nir <ynir@checkpoint.com>
To: = Hisyam F. <f_hisyam@yahoo.co.uk>; ipsec@ietf.org
Sent: Thursday, 29 = November, 2007 12:53:14 AM
Subject: Re: [IPsec] IKEv2 - possible = attack from legitimate node(s)?

Hi Hisyam.

An attack = like this is very feasible, and the IKEv2 protocol does not have any = protection against it. Individual implementations could have some = protections, such as limiting the amount of half-open SAs from a = particular IP address, or limiting the amount of IKE SAs from a = particular peer.

Years ago, = there were some proposals for securing against a DoS attack by, for = example replacing the cookie with a hash of the cookie and a partial = pre-image (say, all the cookie save the last 32 bits).  This would = force the client to brute-force the cookie (taking on average 2^31 hash = operations), by levying a 1-CPU-second "tax" on each connecting client. =  This proposal died, I think because of all kinds of patents = surrounding such technology.


On Nov 27, 2007, at 6:07 AM, = Hisyam F. wrote:

Hi,
 
I'm = relatively new to IPsec. I would like to ask regarding the DoS = protection in IPsec. Based on the IKEv2 standard, there is an = anti-clogging mechanism via "cookie" notification in Notify payload = which prevent DoS attack on message echange (i.e.,phase 1). It = seems that the DoS attack is assumed to have or mounted from spoof IP = address.
 
In that sense, I would like to know whether IPsec = (especially the IKEv2) contains any protection from legitimate = node(s) (as an example DDoS)? In addition, is this type of attack = feasible on IKEv2?
 
Thanks.

For ideas on = reducing your carbon footprint visit Yahoo! For Good this month. 

Scanned by Check = Point Total Security Gateway. 

_____________________= __________________________
IPsec mailing list
IPsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec

For ideas on reducing your carbon = footprint visit Yahoo! = For Good this = month. 

Scanned = by Check Point Total Security Gateway. 


= --Apple-Mail-7--1028960856-- --===============0867533752== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============0867533752==-- From ElisegodkinStacy@annapolischorale.org Thu Nov 29 04:20:59 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxfZr-0007iu-2s; Thu, 29 Nov 2007 04:20:59 -0500 Received: from [71.80.223.118] (helo=d6w99qb1.nv.charter.com) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IxfZq-00058i-JF; Thu, 29 Nov 2007 04:20:59 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host34742644.annapolischorale.org (8.13.1/8.13.1) with SMTP id 3OsrZYWM68.883599.zWy.TT5.9973122689176 for ; Thu, 29 Nov 2007 02:19:49 +0600 Message-ID: <2594201c83260$a0ab76e0$76df5047@D6W99QB1> From: "Cecile Ham" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_2593E_01C83260.A0AB76E0-- From SarahserologyWang@hotelpresident.cz Thu Nov 29 16:10:37 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ixqea-0003NF-K5; Thu, 29 Nov 2007 16:10:36 -0500 Received: from dhcp-0-13-72-d0-76-85.cpe.axion.ca ([72.11.184.166] helo=aucune885f26c3.axion.ca) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ixqea-0002ZW-AX; Thu, 29 Nov 2007 16:10:36 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host58843482.hotelpresident.cz (8.13.1/8.13.1) with SMTP id RIywksio85.827044.JgR.Tu7.8392950546344 for ; Thu, 29 Nov 2007 16:10:28 +0500 Message-ID: <104fe01c832cc$48359f10$a6b80b48@aucune885f26c3> From: "Pamela Wang" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_104FA_01C832CC.48359F10-- From SuesarcophagusForrest@socialinvest.org Thu Nov 29 17:31:25 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ixrum-0002cz-K4; Thu, 29 Nov 2007 17:31:24 -0500 Received: from dsl2.easynet.net.ec ([200.125.204.9] helo=grupo) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ixrul-0004aV-Ow; Thu, 29 Nov 2007 17:31:24 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host96235614.socialinvest.org (8.13.1/8.13.1) with SMTP id dYUOy1zo54.011302.wF0.EZB.7274551775735 for ; Thu, 29 Nov 2007 00:28:28 +0500 Message-ID: <148d501c83248$b2dbc300$0a01a8c0@grupo> From: "Roberta Bingham" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_148D1_01C83248.B2DBC300-- From ipsec-bounces@ietf.org Thu Nov 29 17:37:59 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ixs0y-0005d8-6f; Thu, 29 Nov 2007 17:37:48 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Ixs0w-0005cZ-Kc for ipsec-confirm+ok@megatron.ietf.org; Thu, 29 Nov 2007 17:37:46 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ixs0w-0005bs-9o for ipsec@ietf.org; Thu, 29 Nov 2007 17:37:46 -0500 Received: from mail4-out.unitn.it ([193.205.206.45]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Ixs0v-0006VT-12 for ipsec@ietf.org; Thu, 29 Nov 2007 17:37:45 -0500 Received: from mail4-out.unitn.it (unknown [127.0.0.1]) by mail4-out.unitn.it (Symantec Mail Security) with ESMTP id 2FC36153F0E; Thu, 29 Nov 2007 23:37:43 +0100 (CET) X-AuditID: c1cdce2d-abbcbbb000001013-30-474f3f3605c6 Received: from dit.unitn.it (brenta.dit.unitn.it [193.205.194.4]) by mail4-out.unitn.it (Symantec Mail Security) with ESMTP id DDEB4EAC88; Thu, 29 Nov 2007 23:37:42 +0100 (CET) Received: from [192.168.1.102] (host210-105-dynamic.7-79-r.retail.telecomitalia.it [79.7.105.210]) (authenticated bits=0) by dit.unitn.it (8.12.11.20060308/8.12.11) with ESMTP id lATMbfD4019669 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 29 Nov 2007 23:37:42 +0100 Message-ID: <474F3F37.1030905@dit.unitn.it> Date: Thu, 29 Nov 2007 23:37:43 +0100 From: Csaba Kiraly User-Agent: Thunderbird 1.5.0.13 (Windows/20070809) MIME-Version: 1.0 To: Joy Latten Subject: [IPsec] Re: ESP's use of dummy packets? Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Brightmail-Tracker: AAAAAA== X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org > Joy Latten wrote: > > RFC 4303 introduces the use of dummy packets within ESP. > Section 2.6 states, > A transmitter MUST be capable of generating dummy packets marked > with this value in the next protocol field, and a receiver MUST be > prepared to discard such packets, without indicating an error. > > However, it is not clear to me whether an IPsec/ESP implementation > MUST > use this feature. That is, it MUST send out dummy packets at random > intervals or in a way to shape the traffic. I interpreted the > above statement to mean that an implementation must only have the > capability. > > > That's correct. > You had better be able to discard them if the other end sends them, > though. > Which means you'll have to test that. Which means that you'll have to > find a way to generate them in your lab... so it means that you'll > wind up having to implement it anyway. > > Dear Joy, If you need dummy generation in Linux, we have an open source implementation in the kernel for our Traffic Flow Confidentiality protocol. I'm quite sure it can easily be transformed into an RFC 4303 compliant one. Since this list is not intended to discuss implementations, I'm just pointing you to http://minerva.netgroup.uniroma2.it/discreet/wiki/TfcProject and of course feel free to contact me directly for a patch. I would also like to take the occasion to say that we have made some efforts to extend the Traffic Flow Confidentiality capabilities of IPsec. In our research we were trying to create a separate TFC security protocol, which goes beyond the limited TFC capabilities that were already included in ESPv3. We have included support for size modifications such as padding (with explicit payload size information), fragmentation and aggregation. It also supports packet re-timing, as well as dummy generation and discarding. Finally, the choice of the masking algorithm combining one or more of these basic tools is handled separately. Of course these are just initial steps, and the same ideas can be imagined as part of ESP as well. If there is still interest in the list for TFC, I would be really glad to discuss ideas! Best regards, Csaba _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From MaeblairPhipps@biblegateway.com Thu Nov 29 18:25:03 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ixskg-0002lY-UF; Thu, 29 Nov 2007 18:25:02 -0500 Received: from [201.116.172.33] (helo=tmxa08) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Ixskg-0008CJ-Is; Thu, 29 Nov 2007 18:25:02 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host48916889.biblegateway.com (8.13.1/8.13.1) with SMTP id wxaMRZZB68.410178.tM0.Q4g.6901568503378 for ; Thu, 29 Nov 2007 17:24:38 +0600 Message-ID: <347f01c832df$0c0466d0$32020a0a@TMXA08> From: "Mae Kaiser" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_347B_01C832DF.0C0466D0-- From LoragenreKaplan@chinadigitaltimes.net Thu Nov 29 19:24:42 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxtgP-00016j-NJ; Thu, 29 Nov 2007 19:24:41 -0500 Received: from 62.43.162.51.dyn.user.ono.com ([62.43.162.51] helo=115113480318) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IxtgO-0004dB-6d; Thu, 29 Nov 2007 19:24:41 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host83586349.chinadigitaltimes.net (8.13.1/8.13.1) with SMTP id 017UTzwy30.274597.ZQ2.TJF.6534901331081 for ; Fri, 30 Nov 2007 01:23:59 -0100 Message-ID: <3758601c832e7$595c6240$33a22b3e@115113480318> From: "Kendra Ricks" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_37582_01C832E7.595C6240-- From BonitacannonDaley@washingtonpost.com Thu Nov 29 20:17:09 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IxuVB-0004y5-Fb; Thu, 29 Nov 2007 20:17:09 -0500 Received: from pool-71-186-190-206.bflony.fios.verizon.net ([71.186.190.206] helo=yourm5d4u9r2uv) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IxuVB-0001Uc-6b; Thu, 29 Nov 2007 20:17:09 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host74270014.washingtonpost.com (8.13.1/8.13.1) with SMTP id cIrPrTlr75.663178.biS.4Q1.9681771530986 for ; Thu, 29 Nov 2007 20:16:54 +0500 Message-ID: <4702101c832ee$ba500230$9865fea9@yourm5d4u9r2uv> From: "Cheri Kilgore" To: Cc: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_4701D_01C832EE.BA500230-- From MylestoffeeSpence@cbsnews.com Fri Nov 30 07:06:45 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iy4do-0001s6-JL; Fri, 30 Nov 2007 07:06:44 -0500 Received: from c-71-58-3-107.hsd1.nj.comcast.net ([71.58.3.107] helo=dhg7sq61.hsd1.nj.comcast.net) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iy4do-0005OF-3N; Fri, 30 Nov 2007 07:06:44 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host38891018.cbsnews.com (8.13.1/8.13.1) with SMTP id c5Ve6o4X54.813766.9lR.8De.1252313551537 for ; Fri, 30 Nov 2007 07:06:27 +0500 Message-ID: <11e1b901c83349$79305920$6b033a47@DHG7SQ61> From: "Myles Bray" To: Subject: Your order Date: Fri, 30 Nov 2007 07:06:27 +0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_11E1B5_01C83349.79305920" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_11E1B5_01C83349.79305920 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_11E1B5_01C83349.79305920 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_11E1B5_01C83349.79305920-- From ipsec-bounces@ietf.org Fri Nov 30 09:40:46 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iy72a-0004Ep-5E; Fri, 30 Nov 2007 09:40:28 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1Iy72Y-0004EQ-W3 for ipsec-confirm+ok@megatron.ietf.org; Fri, 30 Nov 2007 09:40:26 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iy72Y-0004EG-M0 for ipsec@ietf.org; Fri, 30 Nov 2007 09:40:26 -0500 Received: from mx12.bbn.com ([128.33.0.81]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Iy72Y-0000za-Cg for ipsec@ietf.org; Fri, 30 Nov 2007 09:40:26 -0500 Received: from dhcp89-089-071.bbn.com ([128.89.89.71]) by mx12.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1Iy72X-0001zu-4T; Fri, 30 Nov 2007 09:40:25 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <473403.13247.qm@web26612.mail.ukl.yahoo.com> References: <473403.13247.qm@web26612.mail.ukl.yahoo.com> Date: Fri, 30 Nov 2007 09:40:36 -0500 To: "Hisyam F." From: Stephen Kent Subject: Re: [IPsec] IKEv2 - possible attack from legitimate node(s)? Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Cc: ipsec@ietf.org, Yoav Nir X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org At 10:54 PM +0000 11/28/07, Hisyam F. wrote: >Hi Yoav, > >Thanks for the reply. Since the attack from legitimate node(s) is >feasible, I agree on your statement that each individual (recepient) >should implements defensive mechanism against such attack. > >Nevertheless, I would like to ask your opinion regarding the IKEv2 >message exchange. As stated in your previous reply, there were >several works have been done in combating DoS i.e., HASH cookie >mechanism etc. It seems that in order to defeat DoS attack, each >technique in literature suggests the initiator to authenticate >him/herself (prove the identity) to the respective responder by >returning the correct cookie. However, I think that this >verification method is efficient to certain degrees subject to the >assumption that an attack is mounted from malicious attacker with >spoofed ID. Since this is not applicable to DDoS as each nodes can >have legitimate ID, does it means it is impossible (I hope not) for >us to propose a better approach for IKEv2? It was a design criterion for IKE (v1 and V2) that neither initiator nor responder disclose authentication credentials over an plaintext channel. Thus any anti-flooding mechanisms based on sending authentication info prior to completion of the first IKE exchange would violate that criterion. Steve _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From NatalielevuloseMcdermott@investmentmap.com Fri Nov 30 10:21:34 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iy7gL-0001cH-MJ; Fri, 30 Nov 2007 10:21:33 -0500 Received: from i03m-62-35-224-45.d4.club-internet.fr ([62.35.224.45] helo=christopcad607) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1Iy7gL-0003lm-9R; Fri, 30 Nov 2007 10:21:33 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host19548786.investmentmap.com (8.13.1/8.13.1) with SMTP id wAD1m4ou59.301054.woc.plZ.9874716773266 for ; Fri, 30 Nov 2007 16:21:20 -0100 Message-ID: <9b34d01c83364$b241c4e0$0201a8c0@christopcad607> From: "Charlene Bowling" To: Subject: Your order approved Date: Fri, 30 Nov 2007 16:21:20 -0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_9B349_01C83364.B241C4E0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 This is a multi-part message in MIME format. ------=_NextPart_000_9B349_01C83364.B241C4E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Even if you have no erection problems Viagra would help you to make = better sex more often and to bring unimaginable plesure to her. Just = disolve half a pill under your tongue and get ready for action in 30 = minutes. The tests showed that the majority of men after taking this = medication were able to have perfect erection during 24 hours! Package Quantity Price in your local drugstore* Our price LearnMoreNow 10 tabs 20 doses $99.95 $34.49 30 tabs 60 doses $299.95 $88.50 60 tabs 120 doses $449.95 $141.02 90 tabs 180 doses $769.95 $176.40 180 tabs 360 doses $1299.95 $298.46 When you are young and stressed up… When you are aged and never give up… Viagra gives you confidence in any chance, every time. ------=_NextPart_000_9B349_01C83364.B241C4E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_9B349_01C83364.B241C4E0-- From CarainvolutionRosas@metacafe.com Fri Nov 30 13:09:23 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyAIk-00083y-MJ; Fri, 30 Nov 2007 13:09:22 -0500 Received: from c209-42.i03-5.onvol.net ([213.217.209.42] helo=rowanhome) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IyAIj-0001cx-Vg; Fri, 30 Nov 2007 13:09:22 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host08074808.metacafe.com (8.13.1/8.13.1) with SMTP id 1egn15Mw34.985454.nKP.E6n.8199383373526 for ; Fri, 30 Nov 2007 19:09:01 -0100 Message-ID: <3c5c4701c8337c$227d56e0$6402a8c0@rowanhome> From: "Celeste Cope" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_3C5C43_01C8337C.227D56E0-- From ipsec-bounces@ietf.org Fri Nov 30 14:50:40 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyBsc-0003QL-N3; Fri, 30 Nov 2007 14:50:30 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IyBsb-0003Q6-Hx for ipsec-confirm+ok@megatron.ietf.org; Fri, 30 Nov 2007 14:50:29 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyBsb-0003Pn-8O for ipsec@ietf.org; Fri, 30 Nov 2007 14:50:29 -0500 Received: from mx11.bbn.com ([128.33.0.80]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IyBsZ-0003gV-5S for ipsec@ietf.org; Fri, 30 Nov 2007 14:50:29 -0500 Received: from dhcp89-089-071.bbn.com ([128.89.89.71]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1IyBsX-00077i-6E; Fri, 30 Nov 2007 14:50:26 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <474F3F37.1030905@dit.unitn.it> References: <474F3F37.1030905@dit.unitn.it> Date: Fri, 30 Nov 2007 14:47:20 -0500 To: Csaba Kiraly From: Stephen Kent Subject: [IPsec] Re: ESP's use of dummy packets? Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Cc: ipsec@ietf.org, Joy Latten X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-bounces@ietf.org Csaba, >... >I would also like to take the occasion to say that we have made some >efforts to extend the Traffic Flow Confidentiality capabilities of >IPsec. In our research we were trying to create a separate TFC >security protocol, which goes beyond the limited TFC capabilities >that were already included in ESPv3. We have included support for >size modifications such as padding (with explicit payload size >information), fragmentation and aggregation. It also supports packet >re-timing, as well as dummy generation and discarding. Finally, the >choice of the masking algorithm combining one or more of these basic >tools is handled separately. Since 4303 already provides for arbitrary padding, and efficient dummy packet generation and discarding, presumably the additional features to which you refer are a management interface to control these extant features, plus packet re-timing and the fragmentation and aggregation features that help optimize channel bandwidth? Steve _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec From CarlylocustWhitt@biblegateway.com Fri Nov 30 15:53:41 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyCrk-000635-Vo; Fri, 30 Nov 2007 15:53:41 -0500 Received: from [88.219.215.152] (helo=sn301311760004) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IyCrk-0005xS-AI; Fri, 30 Nov 2007 15:53:40 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host46604223.biblegateway.com (8.13.1/8.13.1) with SMTP id NfBTKnN557.320037.jDj.6zj.5400957140906 for ; Fri, 30 Nov 2007 21:53:23 -0100 Message-ID: <4a00201c83393$129e1c20$1701a8c0@SN301311760004> From: "Reva Barnhart" To: , =20

Even if you have no erection problems = Viagra would=20 help you to make better sex more often and to bring unimaginable = plesure=20 to her. Just disolve half a pill under your tongue and get ready for = action in=20 30 minutes. The tests showed that the majority of men after taking = this=20 medication were able to have perfect erection during 24 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Viagra gives you confidence in any chance, every time.

------=_NextPart_000_49FFE_01C83393.129E1C20-- From HollieweatherproofLandis@hotelpresident.cz Fri Nov 30 16:47:22 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyDhh-0006Ly-NS; Fri, 30 Nov 2007 16:47:21 -0500 Received: from cable201-233-9-42.epm.net.co ([201.233.9.42] helo=3hygnl6qczhgtuy.une.net.co) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1IyDhe-00021G-Fx; Fri, 30 Nov 2007 16:47:21 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by host35095990.hotelpresident.cz (8.13.1/8.13.1) with SMTP id 9ODPC1tl15.753673.rTA.Sko.6474747380877 for ; Mon, 27 Sep 1999 16:00:37 -0100 Message-ID: <4f2801bf08f0$bd956100$2a09e9c9@3hygnl6qczhgtuy> From: "Rowena Doran" To: , =20

Even if you have no erection problems = Cialis Soft=20 Tabs would help you to make better sex more often and to bring=20 unimaginable plesure to her. Just disolve half a pill under your tongue = and get=20 ready for action in 30 minutes. The tests showed that the majority of = men after=20 taking this medication were able to have perfect erection during = 24=20 hours!

Package Quantity Price in your = local drugstore* Our = price

Learn
More
Now
10 tabs 20 doses $99.95 $34.49
30 tabs 60 doses $299.95 $88.50
60 tabs 120 doses $449.95 $141.02
90 tabs 180 doses $769.95 $176.40
180 tabs 360 doses $1299.95 $298.46

When you are young and stressed = up…
When you are aged and never give up…
Cialis Soft Tabs gives you confidence in any chance, every time.

------=_NextPart_000_4F24_01BF08F0.BD956100-- From ipsec-bounces@ietf.org Fri Nov 30 17:58:37 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyEoR-0000UF-6G; Fri, 30 Nov 2007 17:58:23 -0500 Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IyEoP-0000HK-H6 for ipsec-confirm+ok@megatron.ietf.org; Fri, 30 Nov 2007 17:58:21 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyEoP-0000EB-4o for ipsec@ietf.org; Fri, 30 Nov 2007 17:58:21 -0500 Received: from mx12.bbn.com ([128.33.0.81]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IyEoO-0007Fn-6m for ipsec@ietf.org; Fri, 30 Nov 2007 17:58:21 -0500 Received: from dhcp89-089-071.bbn.com ([128.89.89.71]) by mx12.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1IyEoN-0007pt-3X; Fri, 30 Nov 2007 17:58:19 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <1194632232.2477.636.camel@faith.austin.ibm.com><20071109183409.GB3152@keb e.East.Sun.COM><1194639081.2477.659.camel@faith.austin.ibm.com> Date: Fri, 30 Nov 2007 17:55:16 -0500 To: From: Stephen Kent Subject: RE: [IPsec] Use of SPD in verifying incoming packets X-Spam-Score: 0.0 (/) X-Scan-Signature: 68ba2b07ef271dba6ee42a93832cfa4c Cc: ipsec@ietf.org X-BeenThere: ipsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion of IPsec protocols List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0247621231==" Errors-To: ipsec-bounces@ietf.org --===============0247621231== Content-Type: multipart/alternative; boundary="============_-1015658979==_ma============" --============_-1015658979==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" At 12:25 PM +0100 11/28/07, wrote: >Hi, > >The text in RFC4301 page 24-26 regarding IKE negotiation is not >clear to me. It says > "For example, suppose one starts > with an entry A (from an ordered SPD) that when decorrelated, > yields entries A1, A2, and A3. When a packet comes along that > matches, say A2, and triggers the creation of an SA, the SA > management protocol (e.g., IKEv2) negotiates A." ... > "Alternatively, the original entry from the (correlated) SPD may be > retained and passed to the SA management protocol." >I read this as IKE is allowed as an initiator to propose A in a negotiation. > >However RFC4718 page 21 (section 4.12): > "the initiator should not propose traffic selectors that >violate its own policy. If this rule is not followed, valid traffic >may be dropped." > >Is RFC4718 overruling RFC4301 on this point ? Saying that A should >never be proposed, but "only" A1, A2, A3 proposed. > >If this is the case then I understand that inbound traffic arriving >on an SA need only be validated against the SA and need not be >verified against the access control policy expressed in the >(ordered) SPD. > >Regards >Inger Bohlbro Thw statements in 4301 and 4718 are not really contradictory. Since A is in the SPD, it is allowed under the 4718 criteria you cited. It is preferable to pass A1, A2 and A3, because they allow the responder to more accurately match the initiator's policy to theirs, but either approach is allowed for the initiator. The responder MUST respond with a TS set that reflects the intersection of the initiator's proposal and its SPD. If an SPD is not de-correlated, then the access control check for received traffic is problematic. If the receiver caches the SPD entry A in the SAD, that may give a false acceptance for received traffic, which is not OK. To be secure, the receiver needs to process the received traffic against the ordered SPD, which is a slow process. That's why we specified proper operation for IPsec relative to a decorrelated SPD model. Steve --============_-1015658979==_ma============ Content-Type: text/html; charset="us-ascii" RE: [IPsec] Use of SPD in verifying incoming packets
At 12:25 PM +0100 11/28/07, <Inger.Bohlbro@tietoenator.com> wrote:
Hi,
 
The text in RFC4301 page 24-26 regarding IKE negotiation is not clear to me. It says
      "For example, suppose one starts
      with an entry A (from an ordered SPD) that when decorrelated,
      yields entries A1, A2, and A3.  When a packet comes along that
      matches, say A2, and triggers the creation of an SA, the SA
      management protocol (e.g., IKEv2) negotiates A."  ...
      "Alternatively, the original entry from the (correlated) SPD may be
      retained and passed to the SA management protocol."
I read this as IKE is allowed as an initiator to propose A in a negotiation.
 
However RFC4718 page 21 (section 4.12):
      "the initiator should not propose traffic selectors that violate its own policy. If this rule is not followed, valid traffic may be dropped."
 
Is RFC4718 overruling RFC4301 on this point ? Saying that A should never be proposed, but "only" A1, A2, A3 proposed.
 
If this is the case then I understand that inbound traffic arriving on an SA need only be validated against the SA and need not be verified against the access control policy expressed in the (ordered) SPD.
 
Regards
Inger Bohlbro

Thw statements in 4301 and 4718 are not really contradictory.

Since A is in the SPD, it is allowed under the 4718 criteria you cited. It is preferable to pass A1, A2 and A3, because they allow the responder to more accurately match the initiator's policy to theirs, but either approach is allowed for the initiator.  The responder MUST respond with a TS set that reflects the intersection of the initiator's proposal and its SPD.

If an SPD is not de-correlated, then the access control check for received traffic is problematic. If the receiver caches the SPD entry A in the SAD, that may give a false acceptance for received traffic, which is not OK. To be secure, the receiver needs to process the received traffic against the ordered SPD, which is a slow process. That's why we specified proper operation for IPsec relative to a decorrelated SPD model.

Steve
--============_-1015658979==_ma============-- --===============0247621231== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec --===============0247621231==-- From Detwiler@ukps.net Fri Nov 30 19:26:26 2007 Return-path: Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IyGBe-0006vV-Fl for ipsec-archive@lists.ietf.org; Fri, 30 Nov 2007 19:26:26 -0500 Received: from balt-209-163-119-204.dynamic-dialup.coretel.net ([209.163.119.204]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IyGBY-0004cE-Cy for ipsec-archive@lists.ietf.org; Fri, 30 Nov 2007 19:26:26 -0500 Received: by 10.138.138.3 with SMTP id hWXKaHgiaBiIe; Fri, 30 Nov 2007 19:26:11 -0500 (GMT) Received: by 192.168.65.136 with SMTP id noImXHYnBGACyP.6598461595146; Fri, 30 Nov 2007 19:26:09 -0500 (GMT) Message-ID: <000201c833b0$c315ddf0$cc77a3d1@vaio> From: "Samir Detwiler" To: Subject: dedecnoc Date: Fri, 30 Nov 2007 19:26:06 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C83386.DA3FD5F0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 X-Spam-Score: 3.5 (+++) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a ------=_NextPart_000_0003_01C83386.DA3FD5F0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Been using manster pills for over a month now and I have already seen = gains of almost one inch http://mikaroo.com/ ------=_NextPart_000_0003_01C83386.DA3FD5F0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Been using manster pills for over a month now and I = have=20 already seen gains of almost one inch http://mikaroo.com/
------=_NextPart_000_0003_01C83386.DA3FD5F0--