Subject: [Ipsec] Reauthentication in IKEv2

From: Jyothi <[email-masked]>
Date: Fri, 12 Nov 2004 18:18:25 +0530

>Hi,
>
>I have doubt here.
>
>Even if IKE wants to re-authenticate, it does not know about IPSEC 
>information.
>
>In AUTH exchange, negotiating IPSEC information is MUST (SAi2, SAr2  and 
>Traffic selector payloads).
>
>Again if we want to do IKE exchange for re-authentication only, Why does 
>it requires to send IPSEC information??
>
>I think we may need have one more notify type (REAUTHENTICATION) in AUTH 
>exchange.
>
>If that notify type is received then it ignores the CHILD SA information.
>
>
>Thanks
>Jyothi
>
>
>
>At 08:58 PM 11/10/04 -0500, you wrote:
>>On Wed, 2004-11-10 at 20:27, Geoffrey Huang wrote:
>>
>> > I can see arguments from both sides, I guess.  Even with your re-auth
>> > scheme, a value of "0" seconds could mean "do it now," right?
>>
>>I'd think so; I'd also hope that the encoding should also allow for
>>"reauth in 8 hours" notifications as well.
>>
>>As was pointed out in the secsh working group yesterday for a related
>>user-authentication timeout, there are also accessibility concerns here;
>>some people enter text *very* slowly; 3 minutes may not be sufficient
>>for some.
>>
>>                                                 - Bill
>>
>>
>>
>>
>>_______________________________________________
>>Ipsec mailing list
>>[email-masked]
>>https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Fri, 12 Nov 2004 21:06:44 +0200

I agree that it would be nice if we could only do the IKE_AUTH 
exchange, but this would add a lot more complication to IKE.  I suppose 
a minimal configuration can do a transport mode IPSec SA between the 
gateway and client, but usually it can find the existing IPSec SA.

On Nov 12, 2004, at 2:48 PM, Jyothi wrote:

>> In AUTH exchange, negotiating IPSEC information is MUST (SAi2, SAr2  
>> and Traffic selector payloads).
>>
>> Again if we want to do IKE exchange for re-authentication only, Why 
>> does it requires to send IPSEC information??
>>
>> I think we may need have one more notify type (REAUTHENTICATION) in 
>> AUTH exchange.
>>

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 15 Nov 2004 15:13:19 -0500

> gateway and client, but usually it can find the existing IPSec SA.

it has become clear to me that most, if not all, IKEv2+IPsec
implementations will need to maintain bidirectional linkages between the
IKE SA's and the IPsec SA's. 

with those linkages in place it should be straightforward to pick a
suitable IPsec SA-pair to rekey as part of the reauthentication process
(for instance, you could pick the most recently used SA-pair).

							- Bill