Subject: [Ipsec] Rekey IKE SA

From: Tom Stiemerling <[email-masked]>
Date: Mon, 24 Jan 2005 11:27:29 -0500

Can somebody please clarify the following:

Section 2.18 of IKEv2 draft 17 states that when an IKE SA is being re-keyed
the new initiator and responder
SPI's are supplied in the SPI fields. But it seems to me that the SPI's of
the existing IKE SA are required in these
fields to be able to decrypt the packets (you need the SPI's to be able to
identity which IKE SA the packet belongs
to). Therefore this statement does not make sense to me. Is this a mistake
or am I missing something?

Thanks, Tom

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Geoffrey Huang" <[email-masked]>
Date: Mon, 24 Jan 2005 09:15:36 -0800

I believe it means that while the SPIs in the IKE header are for the parent
SA, the SPIs supplied in the SA payload are for the rekey SA.

-g 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Tom Stiemerling
> Sent: Monday, January 24, 2005 8:27 AM
> To: [email-masked]
> Subject: [Ipsec] Rekey IKE SA
> 
> 
> 
> 
> 
> Section 2.18 of IKEv2 draft 17 states that when an IKE SA is 
> being re-keyed the new initiator and responder SPI's are 
> supplied in the SPI fields. But it seems to me that the SPI's 
> of the existing IKE SA are required in these fields to be 
> able to decrypt the packets (you need the SPI's to be able to 
> identity which IKE SA the packet belongs to). Therefore this 
> statement does not make sense to me. Is this a mistake or am 
> I missing something?
> 
> Thanks, Tom
> 
>