Subject: [Ipsec] REKEY_SA with new SA offer..

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 5 Aug 2005 15:36:06 -0700

Hi,

I could not find it anywhere in the IKEv2 draft whether this is disallowed or not. When either
side wants to send a REKEY message, can it offer a different set of proposals/transforms
from what it offered in the SA payload previously (could be first time or last rekey time) ?
Similarly, can the responder choose a different one from what it offered before ? For example,
when i set up the ESP SA for the first time i offered AES with SHA-1 and when i rekey i offer
ENCR_NULL and SHA-1 ? I don't see why this would be an issue.

-mohan

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Bill Sommerfeld <[email-masked]>
Date: Sat, 06 Aug 2005 18:04:39 +0200

On Sat, 2005-08-06 at 00:36, Mohan Parthasarathy wrote:
>  For example,

changing a real algorithm to ENCR_NULL on a rekey really ought to be an
error.

---

From: "Scott Fluhrer" <[email-masked]>
Date: Sat, 6 Aug 2005 11:40:23 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Bill Sommerfeld
> Sent: Saturday, August 06, 2005 9:05 AM
> To: Mohan Parthasarathy
> Cc: [email-masked]
> Subject: Re: [Ipsec] REKEY_SA with new SA offer..
> 
> > when i set up the ESP SA for the first time i offered AES 
> with SHA-1 
> > and when i rekey i offer ENCR_NULL and SHA-1 ? I don't see 
> why this would be an issue.
> 
> changing a real algorithm to ENCR_NULL on a rekey really 
> ought to be an error.

Not necessarily.  What if we rekeyed because our security policy changed
(that is, the administrator deliberately changed our policy on what
transforms should be used)?

-- 
scott

---

From: Geoffrey Huang <[email-masked]>
Date: Mon, 08 Aug 2005 11:39:24 -0700

> transforms should be used)?

I tend to agree.  The text of the previous e-mail said changing an
algorithm "to ENCR_NULL" ought to be an error, suggesting special-
casing.  I.e., the text of the e-mail suggests changing from ENCR_NULL
to AES wouldn't be an error.  I disagree that one would be allowed but
not the other.

In any case, I think the administrator should be allowed to do as the
administrator pleases.  Otherwise, what would be the point of re-sending
the SA payload?

-g

---

From: Mohan Parthasarathy <[email-masked]>
Date: Mon, 8 Aug 2005 14:33:45 -0700 (PDT)

--- Bill Sommerfeld <[email-masked]> wrote:

> > when i set up the ESP SA for the first time i
> offered AES with SHA-1 and when i rekey i offer
Hmm.. Why ? It is a matter of policy. If the peer is
willing to accept such policy, why is it an error ?
IKEv2 itself cannot say much about it i guess as it is
a matter of policy. Checking to see if i am not
missing anything in the draft..

-mohan