Subject: [Hipsec] NONCE parameter in base exchange?

From: [email-masked] (Ahrenholz, Jeffrey M)
Date: Thu Oct 7 19:09:01 2004

<snip>
> > > Using this method, with the receiver not aware of the sender's
> > > local TSs, you would probably have asymmetric return traffic
> > > (i.e., returning
> > > on another SPI)(unless the receiver sets up its own TSs that
> > > happen to exactly match the sender).=20
>=20
> But IPsec is asymmetric, isn't it? You need two IPsec SAs, with two=20
> SPIs, one in each direction to carry a single TCP connexion. Traffic=20
> will return 'asymmetrically' to 'another' SPI, but return packets=20
> might well flow 'symmetrically' on the IP network, i.e., on the same=20
> path as forward packets (if both peers are using a single net_if wich=20
> is assigned a single IP address).

Right, I meant/should've said "i.e., returning on a SPI other than the
one paired with the outgoing SPI."

As this seems relevant to multihoming, this "sender-side only" traffic
selector concept might be noted in the hip-mm-00 draft, if we add the
NONCE. (although this might alter the concept depicted in Figure 2 (Page
8) if we have multiple SPIs using the same address...)

-Jeff