Subject: [Ipsec] "Original initiator" in IKEv2

From: Paul Hoffman <[email-masked]>
Date: Thu, 21 Apr 2005 09:36:14 -0700

Greetings again. One of the open issues in the IKEv2 clarifications 
document is:
    o  When the document uses the term "original initiator" (or similar
       terms), it is not clear whether or not that term also applies to
       the side that originates an rekeying of the IKE_SA.  That is, if
       Alice starts the first IKE_SA, but then Bob rekeys the IKE_SA, is
       the "original initiator" from that point on now Bob, or is it
       still Alice? Also, if it is Bob, at what exact point does it
       become Bob? This needs to be cleared up on a case-by-case basis
       throughout the document.
----------

The relevant text from the IKEv2 document is:

Section 2.2 (sequence number for message ID):
    That means that after the initial
    exchange, each integer n may appear as the message ID in four
    distinct messages: The nth request from the original IKE initiator,
    the corresponding response, the nth request from the original IKE
    responder, and the corresponding response.

Section 2.6 (cookies):
    Unlike ESP and AH where only the recipient's SPI appears in the
    header of a message, in IKE the sender's SPI is also sent in every
    message. Since the SPI chosen by the original initiator of the IKE_SA
    is always sent first, an endpoint with multiple IKE_SAs open that
    wants to find the appropriate IKE_SA using the SPI it assigned must
    look at the I(nitiator) Flag bit in the header to determine whether
    it assigned the first or the second eight octets.

Section 2.14 (keying material for the IKE_SA):
    The two directions of traffic flow use different keys. The keys used
    to protect messages from the original initiator are SK_ai and SK_ei.
    The keys used to protect messages in the other direction are SK_ar
    and SK_er.

Section 3.1 (generic IKE header):
        --  I(nitiator) (bit 3 of Flags) - This bit MUST be set in
            messages sent by the original initiator of the IKE_SA
            and MUST be cleared in messages sent by the original
            responder. It is used by the recipient to determine
            which eight octets of the SPI was generated by the
            recipient.

----------

Based on those four sections, I propose that "original initiator" is 
always the initiator of the *current* IKE_SA. This makes the spec 
more consistent, easier to implement (because you don't have to 
remember who started the first IKE_SA after you rekey it), and that 
definition works fine with all four sections above.

Comments?

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec