RFC Errata
RFC 4322, "Opportunistic Encryption using the Internet Key Exchange (IKE)", December 2005
Source of RFC: IETF - NON WORKING GROUPArea Assignment: sec
See Also: RFC 4322 w/ inline errata
Errata ID: 2452
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Alfred Hoenes
Date Reported: 2006-03-20
Verifier Name: Sean Turner
Date Verified: 2010-08-06
Section 3.2.5 says:
Section 3.2.5 a) The second paragraph of Section 3.2.5, on page 16, Exit from this state occurs with either a successfully created IPsec SA or a failure of some kind. Successful SA creation results in a transition to the key connection state. should correctly name the state (cf. the Figure in Section 3.2, and Section 3.2.6) by saying: Exit from this state occurs with either a successfully created IPsec SA or a failure of some kind. Successful SA creation results in a | transition to the keyed connection state. ^^ b) The second paragraph on page 17 contains the sentence: [...]. For an OE- pessimistic connection, the initiator makes a transition to the deny connection again with a low lifespan. [...] Conformant to the terminology used in the remainder of the text (cf. the definition in the 3rd paragraph of Section 3.2, on page 12), it should say: vvvvvvvv | [...]. For an OE-paranoid connection, the initiator makes a transition to the deny connection again with a low lifespan. [...] c) The final paragraph of the section, still on page 17, says: The third failure occurs when there is signature failure while authenticating the remote gateway. This can occur when there has been a key roll-over, but DNS has not caught up. In this case again, the initiator makes a transition to the clear-text or the deny connection based upon the connection class. However, the lifespan depends upon the remaining time to live in the DNS. [...] It should say: vvv | The third failure occurs when there is a signature failure while authenticating the remote gateway. This can occur when there has been a key roll-over, but DNS has not caught up. In this case again, the initiator makes a transition to the clear-text or the deny | connection state based upon the connection class. However, the lifespan depends upon the remaining time to live in the DNS. [...] ^^^^^^^ Rationale for the second change: Transitions occur between *states* in the FSM. 'clear-text' and 'deny connection' are names given to two of these FSM states.
Notes:
To facilitate the recognition of the text changes proposed,
I have added change bars ('|') in column 1, and up/down pointing
marker lines ('^^^'/'vvv').