Subject: [Ipsec] 2401bis decorrelation

From: Markku Savela <[email-masked]>
Date: Tue, 8 Feb 2005 11:09:44 +0200

The 2401bis gives an decorrelation algorithm in appendix B.

A policy (abrev. "p" = remote port, "a" = remote address) as follows:

  C1: p = 80 -> A1
  C2: a= 10/8 -> A2

Should decorrelate into (as far as I can see)

  U1: p  = 80, a  = 10/8 -> A1
  U2: p != 80, a  = 10/8 -> A2
  U3: p  = 80, a != 10/8 -> A1

However, the algorithm starts with "put C1 into U", resulting

  U1: p = 80, a  = ANY -> A1

Does the algorithm mean, that when forming the set T, they are removed
from the set U? Otherwise, I cannot see it ending up with right
result.

Just as example, another policy, with selector order reversed

  C1: a= 10/8 -> A2
  C2: p = 80 -> A1

should decorrelate into

  U1: p  = 80, a  = 10/8 -> A2
  U2: p != 80, a  = 10/8 -> A2
  U3: p  = 80, a != 10/8 -> A1

right?

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Markku Savela <[email-masked]>
Date: Tue, 8 Feb 2005 13:53:10 +0200

Never mind, I was confused somehow (maybe still am, but...), I guess
it works..

>   U1: p = 80, a  = ANY -> A1

The correct decorrelated is

and for case

  C1: a= 10/8 -> A2
  C2: p = 80 -> A1

it is

  U1: p  = ANY, a  = 10/8 -> A2
  U2: p  = 80,  a != 10/8 -> A1