Subject: [Hipsec] SA granularity

From: [email-masked] (Pekka Nikander)
Date: Tue Oct 12 02:51:00 2004

I wrote:

> Supporting multiple parallel SAs between any pair of HIs
> has been a non-goal for HIP from the beginning.  The mobility
> and multi-homing extension adds such a feature, but _only_
> for dealing with replay window problems.
>
> If this non-goal is not clear from the base spec / arch spec,
> we need to add explicit text.  And I guess the case is so,
> since we've faced this same issue before.
>
> Anyone willing to draft text to be included in both/either of
> the drafts, noting that _architecturally_ HIP only considers
> host-to-host granularity, and any finer granularity is FFS?

Here is the proposed text to clarify this issue:

       <t>...  In particular, the current
       thinking is limited to a situation where, conceptually, there is
       only one pair of SAs between any given pair of HITs.  In other
       words, from an architectural point of view, HIP only supports
       host-to-host (or endpoint-to-endpoint) Security Associations.
       If two hosts need more pairs of parallel SAs, they should use
       separate HITs for that.  However, future HIP extensions may
       provide for more granularity and creation of several ESP SAs
       between a pair of HITs.</t>

Comments?

--Pekka