Subject: [Hipsec] responding to unknown SPIs

From: [email-masked] (Henderson, Thomas R)
Date: Wed Mar 10 17:21:01 2004

(cross-posted for now to IPsec and HIP mailing lists).

This is a request from the HIP WG for some information from IPsec WG=20
participants.

At last week's HIP meeting, there was some discussion on whether HIP
(which functions similar to an IPsec key management protocol) should=20
respond to ESP packets received with an unknown SPI. =20

Some issues raised included:
- don't IPsec key management protocols ignore these? (It was pointed
out by a participant that the latest draft of IKEv2 has support for
responding to them)
- what if multiple keying daemons (HIP, IPsec) are running on the
same box-- do both respond?
- what is the appropriate response, if there is one?  (inside/outside
SA context, rate limited, request to reestablish the SA?)
- is a response dependent on whether the localhost determines that
it has rebooted recently?
- in practice, if a reboot has occurred, won't applications have lost=20
their context anyway in this case?  What is the scenario for which a=20
response is useful?

In looking at the latest draft (below), it seems that IKEv2 MAY
respond, either within the SA context or outside, to these=20
unknown SPIs, but there is not much further guidance given.

In summary, at the HIP WG it was not clear if this was a useful
mechanism, so we decided to defer to IPsec WG for guidance.  Has
it been found to be useful?

Thanks,
Tom

>From http://www.ietf.org/internet-drafts/draft-ietf-ipsec-ikev2-12.txt

        INVALID_SPI                              11

            MAY be sent in an IKE INFORMATIONAL Exchange when a node
            receives an ESP or AH packet with an invalid SPI. The
            Notification Data contains the SPI of the invalid packet.
            This usually indicates a node has rebooted and forgotten an
            SA.  If this Informational Message is sent outside the
            context of an IKE_SA, it should only be used by the
            recipient as a "hint" that something might be wrong (because
            it could easily be forged).