Subject: [Ipsec] extraction of CHILD SA keys from the key material

From: Jyothi <[email-masked]>
Date: Tue, 21 Dec 2004 11:24:27 +0530

>Hi,
>
>I would like to know  the order of extraction of CHILD SA keys from the 
>key material(KEYMAT) in case ESPwith AUTH and AH .

As per section 2.17 draft-ietf-ipsec-ikev2-17,

(      If multiple IPsec protocols are negotiated, keying material is
       taken in the order in which the protocol headers will appear in
       the encapsulated packet.)

I would like whether the following order is right or not.

>Initiator side:
>
>         KEYMAT = { outbound AH key | outbound ESP encryption key | 
> outbound ESP auth key |

>                         inbound AH key | inbound ESP encryption key | 
> inbound ESP auth key }
>
>Responder side:
>
>         KEYMAT = { |inbound AH key | inbound ESP encryption key | inbound 
> ESP auth key |
>                 outbound AH key | outbound ESP encryption key | outbound 
> ESP auth key
>                               }

Awaiting your valuable responses.

>Thanks in advance,
>Jyothi
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Ravi Kumar <[email-masked]>
Date: Tue, 21 Dec 2004 13:20:09 +0530

Since, AH header appears first before ESP header in encapsulated packets,
your understanding and representation are correct.

Regards,
-Ravi

Jyothi wrote:
> 
>> Hi,
>>
>> I would like to know  the order of extraction of CHILD SA keys from 
>> the key material(KEYMAT) in case ESPwith AUTH and AH .
> 
> 
>>         KEYMAT = { |inbound AH key | inbound ESP encryption key | 
>> inbound ESP auth key |
>>                 outbound AH key | outbound ESP encryption key | 
>> outbound ESP auth key
>>                               }
> 
> 
> 
> ------------------------------------------------------------------------
>