Subject: [Ipsec] SPI values in proposals

From: Alejandro Perez Mendez <[email-masked]>
Date: Fri, 30 Sep 2005 20:53:14 +0200

Hi all!
When an IKE_AUTH/CREATE_CHILD_SA exchange is performed, an SPI value
must be included in the Protocol substructure of the Payload SA.
If "Alice" is the initiator and "Bob" is the responder, the SPI values
sent are SPI-A(SPI value sent by Alice) and SPI-B (SPI value sent by
Bob).

When the IPsec SA must be created, there are two ways to do this:

case a) 

        Alice				Bob
        --------		     --------
        outbound ------ SPI-A ----- >  inbound
        inbound  <-----  SPI-B ------  outbound
        
case b)

        Alice				Bob
        --------		     --------
        outbound ------ SPI-B ----- >  inbound
        inbound  <-----  SPI-A ------  outbound
        
What is the correct way?
My opinion is that case a) is the correct way, but It's not clear.

Regards!

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Scott Fluhrer <[email-masked]>
Date: Fri, 30 Sep 2005 11:59:59 -0700 (PDT)

> When the IPsec SA must be created, there are two ways to do this:

Nope, it's (B) -- everyone picks their own inbound SPIs.

-- 
scott