Subject: RE: [Ipsec] INVALID_KE_PAYLOAD and clarifications document

From: [email-masked]
Date: Mon, 10 Oct 2005 17:25:26 +0300

Tero Kivinen wrote:

> I think that version is also good, as it gives only one option.
> Another option would be to say "value MUST be copied to later
> retries". That version could allow later some optional statefull 
> error processing to be done in case if IKE_SA_INIT requests too, 
> but I do not think we need that.

I agree, we don't need that (and even if we did need that, it
would IMHO be a non-trivial technical change to the IKEv2 spec,
not a clarification).

> > Does this look right to you?
> 
> Yes.
> 
> Do we already have section saying what to do if N(COOKIE) returned by
> the initiator is incorrect? If not we need to add that, saying that if
> N(COOKIE) returned is invalid, then N(COOKIE) is simply ignored and
> processing continues just like it never was there, meaning that if
> cookie is required new cookie is requested, and if no cookie is
> required then processing goes forward. 

We're planning to add a section about that in -06 (as was hinted
by the text "see also Section 2.5 of this document for more text 
about invalid cookies" -- but the current draft doesn't have 
Section 2.5 yet :-)

Cheers,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec