Subject: Re: [Ipsec] SPI values for messages outside of an IKE_SA

From: Geoffrey Huang <[email-masked]>
Date: Wed, 29 Jun 2005 10:45:00 -0700

Hi Paul,

I prefer to be liberal in what you expect.  That being said, I think the value should simply be ignored by the recipient.

-g

-----Original Message-----

From:  Paul Hoffman <[email-masked]>
Subj:  [Ipsec] SPI values for messages outside of an IKE_SA
Date:  Mon Jun 27, 2005 8:36 pm
Size:  1K
To:  IPsec WG <[email-masked]>

The current draft of the clarifications document says:

6.9  SPI values for messages outside of an IKE_SA

    The IKEv2 specification does not say what SPI values should be used
    in the IKE header for the small number of notifications that are
    allowed to be sent outside of an IKE_SA.  Note that such
    notifications are explicitly *not* Informational exchanges; Section
    1.5 makes it clear that these are one-way messages that must not be
    responded to.

    There are two cases when such a one-way notification can be sent:
    INVALID_IKE_SPI and INVALID_SPI.  In both cases, there are no IKE SPI
    values that would be meaningful to the recipient of such a
    notification.

    A strict interpretation of the specification would require the sender
    to invent garbage values for the SPI fields.  However, we think this
    was not the intention, and using zero values is acceptable.

Can we come to consensus on what to use? If you feel it doesn't 
matter, feel free to say that, but if you feel that a particular 
value is important, let's try to find it.

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Geoffrey Huang <[email-masked]>
Date: Wed, 29 Jun 2005 11:54:00 -0700

I disagree.  It doesn't make future evolution impossible.  In the future, if we ever decide to include meaningful data in the SPI field, the receiver merely needs to pay attention to this data.

The errant sender (who hitherto sent junk) then needs to address its bug.  There's no prevention of future functionality by being liberal in what you accept.  On the other hand, being liberal encourages interoperability.

-g

-----Original Message-----

From:  Henry Spencer <[email-masked]>
Subj:  RE: [Ipsec] SPI values for messages outside of an IKE_SA
Date:  Wed Jun 29, 2005 11:30 am
Size:  846 bytes
To:  IP Security List <[email-masked]>

On Wed, 29 Jun 2005, Paul Koning wrote:
> Asking for zeroes in the padding rather than arbitrary bytes is fine,
> but DON'T require the receiver to check it.  Instead, tell the
> receiver to ignore it.
> 
> "Be strict in what you send, liberal in what you receive".  Not
> checking is more efficient; it also makes future evolution easier.

On the contrary:  it makes future evolution impossible, because it gives
developers no incentive to fix broken software that sends random non-zero
trash or attempts to misuse those bytes for transmission of private
information. 

                                                          Henry Spencer
                                                       [email-masked]