Subject: [Ipsec] Question about delete IKE SA

From: Tom Stiemerling <[email-masked]>
Date: Wed, 11 May 2005 15:39:00 -0400

Can anybody provide a definitive answer about whether a delete IKE SA
payload needs to be replied to with another delete IKE SA payload, or
whether an empty INFORM response is sufficient to acknowledge the
delete?

Thanks,

Tom Stiemerling
Senior Software Developer
Certicom Corp.
Tel: 905 501 6087
http://www.certicom.com/

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Geoffrey Huang <[email-masked]>
Date: Wed, 11 May 2005 12:52:58 -0700

Tom,

Look at section 1.4 of the IKEv2 draft.  Your answer is "normally" :-).

Actually, this text seems to be referring to deletion of IPSec SAs.  For
IKE SAs, really the only thing that you need to acknowledge any request
is a response that matches the request's message ID.  Also from 1.4:

"That response MAY be a message with no payloads."

-g

Tom Stiemerling wrote:
> ------------------------------------------------------------------------
>

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 12 May 2005 11:49:10 +0300

> whether an empty INFORM response is sufficient to acknowledge the

As the IKE SA is bidirectional and there is no way to delete it only
in one direction, I would say no need to add another delete IKE SA
payload to the reply packet.

The IKE SA delete payload does NOT contain SPI at all, it only has
Protocol ID of 1 for IKE SA, and SPI size of zero, so there is no way
to delete any other IKE SA than the current one. Thus after the any
reply is received from the other end the IKE SA is deleted, thus empty
acknowledge response is enough to finish the exchange.

So do not send delete payload in the reply packet, but accept the
reply packet even if the other end added a delete payload there.

The document itself does not explicitly specify anything for this case
(Note that replying with SPIs is NOT MANDATORY even for the IPsec
SAs).

The text explaining how to reply with the deletes to other direction,
clearly cannot be used for the IKE SAs as there is no SPIs to be
included in the delete payload. Also the paragrap starts with saying
"ESP and AH SAs always exist in pairs, with one SA in each
direction...."
-- 
[email-masked]