Online Certificate Status Protocol (OCSP) Extensions to IKEv2
draft-myers-ikev2-ocsp-05

Approval announcement
Draft of message to be sent after approval:

Announcement

From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Cc: Internet Architecture Board <iab@iab.org>,
    RFC Editor <rfc-editor@rfc-editor.org>
Subject: Protocol Action: 'OCSP Extensions to IKEv2' to Proposed 
         Standard 

The IESG has approved the following document:

- 'OCSP Extensions to IKEv2 '
   <draft-myers-ikev2-ocsp-06.txt> as a Proposed Standard

This document has been reviewed in the IETF but is not the product of an
IETF Working Group. 

The IESG contact person is Russ Housley.

A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-myers-ikev2-ocsp-06.txt

Ballot Text

Technical Summary

  While IKEv2 supports public key based authentication (PKI), the
  corresponding use of in-band CRLs is problematic due to unbounded CRL
  size.  The size of an OCSP response is however well-bounded and small.
  This document defines two extensions to IKEv2 which enable the use of
  OCSP for in-band signaling of certificate revocation status.  Two new
  content encodings are defined for use in the CERTREQ and CERT
  payloads: OCSP Responder Hash and OCSP Response.  An OCSP Responder
  Hash CERTREQ payload triggers transmission of an OCSP Response CERT
  payload.

  When certificates are used with IKEv2, the communicating peers need a
  mechanism to determine the revocation status of the peer's
  certificate.  OCSP is one such mechanism.  This document applies when
  OCSP is desired and security policy prevents one of the IKEv2 peers
  from accessing the relevant OCSP responder directly.  Firewalls are
  often deployed in a manner that prevents such access by IKEv2 peers
  outside of an enterprise network.

Working Group Summary

  This document is not a product of any IETF Working Group, but it has
  been discussed on both the IPsec mail list and the PKIX mail list.

Protocol Quality

  This document was reviewed by Russ Housley for the IESG.

RFC Editor Note