Subject: [Ipsec] Question regarding IKE SA validity

From: Yoav Nir <[email-masked]>
Date: Tue, 12 Jul 2005 14:35:17 +0300

Hi.

Section 1.2 of draft -17 says on page 8, "At this point in the 
negotiation ... all but the headers of all the messages that follow are 
encrypted and integrity protected."  This is right after the 
IKE_SA_INIT exchange, but before the IKE_AUTH exchange.

Suppose at this point, the initiator needed to send an INFORMATIONAL 
exchange.  Would it be appropriate to use the encryption keys, or is 
this prohibited until the IKE_AUTH exchange completes successfully?  
IOW, when section 1.4 says "INFORMATIONAL exchange MUST ONLY occur 
after the initial exchanges" what do they mean by "initial exchanges"?  
Is it only the IKE_SA_INIT, or the combination of IKE_SA_INIT and 
IKE_AUTH?

Thanks.

Yoav

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec