Subject: [Hipsec] Some UPDATE handling issues

From: [email-masked] (Mika Kousa)
Date: Thu Apr 1 05:30:01 2004

One more thing which occurred while implementing UPDATE:
(using section numbers from draft-hip10-pre1)

Chapter 8.9 (Initiating rekeying) does not say anything about on setting
up some initial IPsec SA, because we need to know the New SPI value in the
NES TLV of the UPDATE to be sent. Only after some four pages from 8.9
at section 8.10.2 there is a small sentence "It must also complete its new
incoming SA."

Why not adding some explicit note on creating the new SA to section 8.9,
eg. between bullet points 3 and 4 ? It is always better to read explicit
instructions than trying to figure out what is really needed in the real
world implementation by reading between the lines and spending n^n hours
before the great moment of "aaaa..so this is what was really meant in the
specs and this is what I should have done even though the specs give no
hints that it is needed" happens. And yes, there is a comment "The
following steps define the conceptual processing rules", but future
developers of HIP would avoid the same problems as I've had.