Subject: [Ipsec] Rekeying IKE SA

From: Jyothi <[email-masked]>
Date: Tue, 21 Dec 2004 11:15:33 +0530

Hi all,

I have some doubts regarding the Rekeying of IKE SA.

SG1==============SG2.

Initially SG1 initiated IKE Exchange and IKE SA and CHILD SAs are established.

If the SG2 (responder of IKE SA ) initiated the CREATE_CHILD_SA exchange to 
establish new IKE SA keys, how do we know who will be the initiator for the 
new IKE SA (SG1 or SG2) ??

If it is SG1,
    that means we will be negotiating  the responder nonce, KEr and 
responder SPI  in CREATE_CHILD_SA request.

So, in Key material calculation, what SPI and what nonce should be used as 
initiator SPI and initiator nonce??

Please clarify my doubt.

Thanks in advance,
Jyothi
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Ravi Kumar <[email-masked]>
Date: Tue, 21 Dec 2004 13:08:02 +0530

Hi,

In your example, SG2 should be considered as Initiator.
SPIi and SPIr need to be taken from Proposal of SA.

Regards
Ravi

Jyothi wrote:
> If the SG2 (responder of IKE SA ) initiated the CREATE_CHILD_SA exchange 
> to establish new IKE SA keys,* how do we know who will be the initiator 
> for the new IKE SA (SG1 or SG2) ??
> 
> *If it is SG1,
> So, in Key material calculation, what SPI and what nonce should be used 
> as initiator SPI and initiator nonce??
> 
> Please clarify my doubt.
>  
> 
> Thanks in advance,
> Jyothi
> 
> 
> ------------------------------------------------------------------------
>