Subject: [Ipsec] IKEv2 rekeying question

From: Fukumoto Atsushi <[email-masked]>
Date: Wed, 27 Jul 2005 21:12:56 +0900

In section "2.8 Rekeying", draft-ietf-ipsec-ikev2-17.txt says:
       If redundant SAs are created though such a collision, the SA
   created with the lowest of the four nonces used in the two exchanges
   SHOULD be closed by the endpoint that created it.

Questions are:

1.  What is the definition of comparison when determining the lowest
of the four nonces?  Is it to interpret the nonces as big-endian
integers (in that case, shorter nonces will be lower, unless the
longer nonces happen to have zeros at its head)?  I think another
possibility is to consider nonces as strings of octets and compare
octet-by-octet from head to tail.

2.  I didn't understand the phrase "by the endpoint that created it",
does it mean the endpoint that initiated the exchange which had the
lowest nonce?  I understand "SHOULD be closed" means sending DELETE,
as described in clarification draft 04 section 5.6.

					FUKUMOTO Atsushi
					[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 27 Jul 2005 15:57:51 +0300

> octet-by-octet from head to tail.

I interpreted it as memcmp...

> as described in clarification draft 04 section 5.6.

The endpoint who initiated the exchange which had the smallest nonce,
should send delete notification to the SA. Of course all child SAs are
moved to the winning IKE SA before the old one is deleted (this
happens in both ends).

There is also couple of different cases there, for example the case
where you initiated rekey, got reply back and finished rekey, and only
after that you receive the first packet of the other ends rekey (==
simulateneous rekey). I.e in that case you already finished completely
with the rekey, before you even see the first packet from the second
exchange and notice that it was simultaneous rekey. And if this second
one is the winning one, then you need to move the child SAs again to
this new SA.
-- 
[email-masked]