Subject: [Ipsec] Confusion regarding "proposal may contain multiple IPSec protocols"

From: khan wadood <[email-masked]>
Date: Sat, 4 Sep 2004 15:54:51 +0100 (BST)

i have confusion regarding  

"Each proposal may contain multiple IPsec protocols
(where a protocol is IKE, ESP, or AH)"

in my view point it should be like 

"Each proposal contains a protocol(where a protocol is
IKE, ESP, or AH)"

because you always send IKE_SA and CHILD_SA in
separate SA payloads (SAi1, SAi2), so you always send
one protocol in SA proposal or proposals.

for subsequent CHILD_SA, you would always send one
protocol in SA proposal or proposals. 

if you are sending lets say ESP protocol and AH
protocol in the CHILD_SA proposal or proposals,
basically you are negotiating two SAs (one for ESP and
one for AH) with one SA payload. 

Conceptually, one SA payload should represent a
Security Association either for IKE or ESP or AH.

otherwise my previous point of view that in first SA
payload (SAi1) why dont we send proposals having
protocols IKE and ESP or AH respectively.

any comments would be highly appreciated.     

wadood

________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 6 Sep 2004 11:19:41 +0300

> "Each proposal contains a protocol(where a protocol is

Yes, with current RFC2401bis it also could be that. For the later
extensiuons, that might not be true anymore. 

> one for AH) with one SA payload. 

Yes, according to RFC2401bis. So if you plan to support RFC2401bis
architecture only, you do not have any need for support for multiple
protocols, and you can reject all those proposals having multiple
protocols (i.e. you must know how to skip them, and do not select
them). 
-- 
[email-masked]