Subject: [Ipsec] Rekeying SA bundles

From: Alejandro Perez Mendez <[email-masked]>
Date: Sat, 01 Oct 2005 14:23:19 +0200

Hi! I need some clarifications.

The IKEV2 clarifications document, in the section 5.1, says:
        << When rekeying an existing
        CHILD_SA, the leading N payload of type REKEY_SA MUST be
        included and MUST give the SPI (as they would be expected in
        the headers of inbound packets) of the SAs being rekeyed. >>

What about SA bundles? REKEY_SA notification payload can identify only
one inbound SA. 
I think there are at least three ways to do this:

a) Two(or more) notification payload must be included indicating the SPI
of all the inbound SAs of the SA bundle.

b) Two(or more) CREATE_CHILD_SA exchanges must be started to rekey all
SAs in the SA bundle.

c) The REKEY_SA identifies only one of the SAs in the bundle, but this
is enough to identify the entire SA bundle. The responder knows all the
SPI values.

d)....

Thanks for your help.
Regards!

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 5 Oct 2005 13:06:14 +0300

Alejandro Perez Mendez writes:
> What about SA bundles?

There is no bundles in the IKEv2 + RFC 2401bis.

You can create AH+ESP "bundle" with IKEv2 and RFC2401bis, but it
happens so that you first create ESP SA with the traffic selectors
matching the actual traffic, and then you create AH SA with traffic
selectors matching the ESP SA traffic (i.e. protocol ESP, IP addresses
of the gateways etc). 

> REKEY_SA notification payload can identify only one inbound SA.

Yes, and as there is no bundles, that is enough.  If you rekey AH+ESP
"bundle" described above, then you simply rekey both SAs (AH and ESP)
separately). 

> b) Two(or more) CREATE_CHILD_SA exchanges must be started to rekey all

As there is no other relation than traffic selectors betwen the AH and
ESP, this is the correct way to do the thing.

Note also, that as there is no bunndles in IKEv2 + RFC2401bis you do
not need to provide support for the SA payloads having multiple
protocols. That will simplify the parsing and generation of SA
payloads. Also as there is no real reason for use multiple proposals
in the IKEv2 either (we can encode everything we really want inside
one proposal having multiple transforms), you can also leave that
feature out (i.e. in normal case you have exactly one proposal having
exactly one protocol, and inside those there is multiple transforms).

Encoding the SA payload like we did in the IKEv1 i.e having separate
proposal for each transform set (i.e. only single transforms inside
proposal) should not be used as it simply makes the packets bigger
and may cause fragmentation.

So use this:

SA payload
    Proposal substructure
	Proposal # = 1
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 9
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)

And not this (which is identical in the policy point of view):

SA payload
    Proposal substructure
	Proposal # = 1
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 2
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 3
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 4
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 5
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 6
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 256
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 7
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 8
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 9
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 10
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 11
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 12
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 192
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 13
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 14
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 15
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 16
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 17
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 18
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 12 (AES-CBC)
	    Attribute 14 (Key-length) = 128
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 19
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 20
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 1 (HMAC_MD5_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 21
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 22
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 2 (HMAC_SHA1_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
    Proposal substructure
	Proposal # = 23
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 1 (Extended Sequence numbers)
    Proposal substructure
	Proposal # = 24
	Protocol ID = ESP
	SPI size = 4
	SPI = 0x12345678 (inbound SPI for the peer generating this)
	# transforms = 3
	Transform substructure
	    Transform type = 1 (encryption algorithm)
	    Transform ID = 3 (3DES)
	Transform substructure
	    Transform type = 3 (integrity algorithm)
	    Transform ID = 5 (AES_XCBC_96)
	Transform substructure
	    Transform type = 5 (integrity algorithm)
	    Transform ID = 0 (No Extended Sequence numbers)
-- 
[email-masked]

---

From: Alejandro Perez Mendez <[email-masked]>
Date: Wed, 05 Oct 2005 12:19:10 +0200

> There is no bundles in the IKEv2 + RFC 2401bis.

But I what to use IKEv2 + RFC 2401. In this combination, there are
bundles possibility.
What is the desired behaviour in this case?  Note that if IKEv2 allows
multiple protocol proposals, it allows, IMHO, old style AH+ESP bundles.

Thanks for your response.

Alejandro

---

From: Stephen Kent <[email-masked]>
Date: Wed, 5 Oct 2005 07:45:21 -0400

>Thanks for your response.

While it may be technically possible top use 
IKEv2 with 2401 vs. 2401bis, there are a lot of 
mismatches between the functionality offered by 
this pairing, so we don't recommend it.

Steve

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 6 Oct 2005 13:32:14 +0300

> But I what to use IKEv2 + RFC 2401. In this combination, there are

It is also possible to use IKEv2 and some other RFCs too, but IKEv2 do
require RFC2401bis not RFC2401. You can extend the IKEv2 to support
other RFCs (including RFC2401), but then you are creating extensions,
not using the base IKEv2 + RFC2401bis combination.

> multiple protocol proposals, it allows, IMHO, old style AH+ESP bundles.

The reason IKEv2 allows multiple protocol proposal is partly because
of the copied structure of the ISAKMP and partly because it do allow
us to extend the protocol in the future.

IKEv2 could be used also for old style AH+ESP bundles, but when used
with RFC2401bis there is no requirement for that kind of support. Thus
if you implement IKEv2 and RFC2401bis there is no need to support
those.

The desired behavior is not specified, as it is outside the scope of
these documents. If you want to define what is the desired behavior
then you need to write a document describing how to use IKEv2 with
RFC2401. I do not think we should be wasting our time to even consider
such document.

The RFC2401bis describes how the same effect (AH+ESP) can be done
using different method, and the IKEv2 rekeying text is completely in
sync in that.
-- 
[email-masked]