Subject: [Ipsec] SPI values for messages outside of an IKE_SA

From: Paul Hoffman <[email-masked]>
Date: Mon, 27 Jun 2005 20:36:04 -0700

The current draft of the clarifications document says:

6.9  SPI values for messages outside of an IKE_SA

    The IKEv2 specification does not say what SPI values should be used
    in the IKE header for the small number of notifications that are
    allowed to be sent outside of an IKE_SA.  Note that such
    notifications are explicitly *not* Informational exchanges; Section
    1.5 makes it clear that these are one-way messages that must not be
    responded to.

    There are two cases when such a one-way notification can be sent:
    INVALID_IKE_SPI and INVALID_SPI.  In both cases, there are no IKE SPI
    values that would be meaningful to the recipient of such a
    notification.

    A strict interpretation of the specification would require the sender
    to invent garbage values for the SPI fields.  However, we think this
    was not the intention, and using zero values is acceptable.

Can we come to consensus on what to use? If you feel it doesn't 
matter, feel free to say that, but if you feel that a particular 
value is important, let's try to find it.

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Michael Richardson <[email-masked]>
Date: Tue, 28 Jun 2005 14:09:00 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Paul" == Paul Hoffman <[email-masked]> writes:
    Paul>     A strict interpretation of the specification would require
    Paul> the sender to invent garbage values for the SPI fields.
    Paul> However, we think this was not the intention, and using zero
    Paul> values is acceptable.

    Paul> Can we come to consensus on what to use? If you feel it
    Paul> doesn't matter, feel free to say that, but if you feel that a
    Paul> particular value is important, let's try to find it.

  Set to zero, mandate not checking.

- -- 
] Michael Richardson          Xelerance Corporation, Ottawa, ON |  firewalls  [
] mcr @ xelerance.com           Now doing IPsec training, see   |net architect[
] http://www.sandelman.ca/mcr/    www.xelerance.com/training/   |device driver[
]                    I'm a dad: http://www.sandelman.ca/lrmr/                 [

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 28 Jun 2005 18:19:45 -0700

>     values that would be meaningful to the recipient of such a
Why is not meaningful to the recepient of such a notification ? At least for INVALID_IKE_SPI,
 return what you received. The other end sent it because it still has "state". To clean up the state,
returning what you received might be useful.  

For INVALID_SPI, just use zeroes for the IKE SPI fields.

-mohan