Subject: [Ipsec] 64 bit/8 byte Life Time Duration attribute for Kilo bytes Query

From: vamsi <[email-masked]>
Date: Tue, 04 Oct 2005 11:07:05 -0700

Hi,

  Rfc 2407 (IP Security Domain of Interpretation) states that Life 
time attribute  is a variable length SA attribute  and that 
particular text is as shown below

4.5 IPSEC Security Association Attributes

    The following SA attribute definitions are used in Phase II of an IKE
    negotiation.  Attribute types can be either Basic (B) or Variable-
    Length (V).  Encoding of these attributes is defined in the base
    ISAKMP specification.

    Attributes described as basic MUST NOT be encoded as variable.
    Variable length attributes MAY be encoded as basic attributes if
    their value can fit into two octets.  See [IKE] for further
    information on attribute encoding in the IPSEC DOI.  All restrictions
    listed in [IKE] also apply to the IPSEC DOI.

        Attribute Types

         class                      value           type
        -------------------------------------------------
        SA Life Type                1               B
        SA Life Duration            2               V

How does a receiver should behave if it receives a  Life time 
duration  attribute of length 64bit/8 byte for Kilobytes?
If it doesn't support more than 4 bytes, does it has to Reject the 
Negotiation?
Most of the implementations entertain 4 byte length attribute .

Please give your comments on this Life time duration attribute of 
length more than 4 bytes.

Thanks!

regards
   vamsi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 5 Oct 2005 13:19:58 +0300

> If it doesn't support more than 4 bytes, does it has to Reject the 

I do not think it should be rejecting the negotiation because of that.

If the lifetime is just encoded as 8 bytes but higher 4 bytes are
zero, then it should simply use it as 32 bit value. If the value is
actually more than 32-bit, then it should work just like it works when
it has smaller lifetime for kilobytes configured, i.e. send
RESPONDER-LIFETIME with its own lifetime.

-- 
[email-masked]