Subject: RE: [Ipsec] re-authentication in IKEv2

From: "Bora Akyol \(bora\)" <[email-masked]>
Date: Mon, 23 May 2005 09:56:34 -0700

What happens to the associated IPSEC SAs when the old IKE SA is deleted?

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> [email-masked]
> Sent: Monday, May 23, 2005 7:14 AM
> To: [email-masked]; [email-masked]
> Subject: RE: [Ipsec] re-authentication in IKEv2
> 
> Thomas Gschwendtner writes:
> >
> > Once an IKEv2 SA got established and is up for a while, can the
> > initiator start another  AUTH exchange on that SA (e.g.
> > because the used EAP method requires frequent re-authentication)?
> > If yes, could you please point me to the section of the IKEv2 draft
> > that says so?
> 
> There's no way to do reauthentication within a single IKE_SA;
> if the initiator wants to reauthenticate, it just creates a
> new IKE_SA (the same way as the original one) and deletes the
> old one.
> 
> Best regards,
> Pasi
> 
> _______________________________________________
> Ipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 May 2005 20:32:33 +0300

They're erased automatically.  There is no provision (yet) for 
transferring them to the new IKE SA.

It is an idea for an addition to the re-authentication draft. I don't 
see how we could add it without making a new notification type, which 
may complicate things, so I don't know if it's a good trade-off in 
terms of complexity vs efficiency.