Subject: [Ipsec] Rekeying IKE_SA

From: Tom Stiemerling <[email-masked]>
Date: Wed, 16 Feb 2005 12:42:47 -0500

Couple of questions about creating child IKE_SA:

When you create a child IKE SA, does the old IKE_SA get implicitly deleted,
or do you have to
send a Delete payload in an INFORMATIONAL exchange subsequently to the
CREATE_CHILD_SA
exchange to delete the old IKE_SA? Also, who sends the Delete payload
first, the initiator of the
CHILD_SA exchange?

Thanks, Tom

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Geoffrey Huang" <[email-masked]>
Date: Wed, 16 Feb 2005 22:06:59 -0800

See section 2.8 of the draft:

The Delete payload to delete itself MUST be the last request
   sent over an IKE_SA.

This implies that you explicitly delete the old IKE SA.

As far as who sends the delete payload "first" -- I believe the answer
should be whoever has the shorter life time.  So suppose you have two peers,
A and B.  Suppose the lifetime on A is configured for 30 minutes, whereas
B's lifetime is configured for 60 minutes.  A will initiate the rekey at 30
minutes (or probably a bit before that).  Since A's lifetime expires first,
I would imagine that A would send the delete first.

I do not believe that the rekey of an IKE SA via the create-child exchange
should be the impetus for the responder of the exchange to send out a delete
message.  (Was that clear?)

-g

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Tom Stiemerling
> Sent: Wednesday, February 16, 2005 9:43 AM
> To: [email-masked]
> Subject: [Ipsec] Rekeying IKE_SA
> 
> 
> 
> 
> 
> When you create a child IKE SA, does the old IKE_SA get 
> implicitly deleted, or do you have to send a Delete payload 
> in an INFORMATIONAL exchange subsequently to the 
> CREATE_CHILD_SA exchange to delete the old IKE_SA? Also, who 
> sends the Delete payload first, the initiator of the CHILD_SA 
> exchange?
> 
> Thanks, Tom
> 
>

---

From: Tom Stiemerling <[email-masked]>
Date: Thu, 17 Feb 2005 09:59:44 -0500

Thanks Geoffrey. My question actually related only to creating a child IKE
SA (equivalent to
rekeying the IKE SA), and not deleting an IKE SA in general. The spec says
that when you
create a child IKE SA  you move all the child IPSEC SAs to the new IKE SA,
and delete the
original IKE SA. So my question was whether this is done implicitly as part
of the create child
sa exchange, or done subsequently using an informational exchange.

Thanks, Tom

---

From: "Geoffrey Huang" <[email-masked]>
Date: Thu, 17 Feb 2005 09:39:31 -0800

My opinion is that it's done separately using an informational exchange.

-g 

> From: Tom Stiemerling [mailto:[email-masked]] 
> Sent: Thursday, February 17, 2005 7:00 AM
> To: Geoffrey Huang
> Cc: [email-masked]
> Subject: RE: [Ipsec] Rekeying IKE_SA
> 
> 
> 
> 
> 
> Thanks Geoffrey. My question actually related only to 
> creating a child IKE SA (equivalent to rekeying the IKE SA), 
> and not deleting an IKE SA in general. The spec says that 
> when you create a child IKE SA  you move all the child IPSEC 
> SAs to the new IKE SA, and delete the original IKE SA. So my 
> question was whether this is done implicitly as part of the 
> create child sa exchange, or done subsequently using an 
> informational exchange.
> 
> Thanks, Tom
> 
> > should be whoever has the shorter life time.  So suppose 
> you have two
> peers,
> > A and B.  Suppose the lifetime on A is configured for 30 minutes, 
> > whereas B's lifetime is configured for 60 minutes.  A will initiate 
> > the rekey at
> 30
> > should be the impetus for the responder of the exchange to 
> send out a
> delete