Subject: Re: [Ipsec] IKEv2 CHILD_SA handling after rekeying IKE_SA

From: Alejandro Perez Mendez <[email-masked]>
Date: Tue, 15 Nov 2005 11:12:07 +0100

El mar, 15-11-2005 a las 18:56 +0900, Fukumoto Atsushi escribió:
> Alejandro Perez Mendez wrote:
> > My interpretation is: After rekeying an IKE_SA, the new one is the only
> > one that controls the CHILD_SAs created by the old IKE_SA. The is no
> > CHILD_SA sharing, because they are "transferred" from old to new IKE_SA.
> > 
> 
> 
> Let me clarify my point: you are correct if rekeying does not collide,
> but draft-17 section 2.8 states:
> 
>    If the two ends have the same lifetime policies, it is possible
>    that both will initiate a rekeying at the same time (which will
>    result in redundant SAs)."
> 
> and,
> 
>    This form of rekeying may temporarily result in multiple similar SAs
>    between the same pairs of nodes. When there are two SAs eligible to
>    receive packets, a node MUST accept incoming packets through either
>    SA. If redundant SAs are created though such a collision, the SA
>    created with the lowest of the four nonces used in the two exchanges
>    SHOULD be closed by the endpoint that created it.
> 
> Thus, redundant IKE_SAs are created, and the implementation MUST be
> able to accept this, if rekeying IKE_SA is supported, if I understand
> correctly.
> 
> 
> 					FUKUMOTO Atsushi
> 					[email-masked]

umm, you are right. I interpreted this text only for CHILD_SA, but
redudandant SAs also includes redundant IKE_SAs.
In this case IMHO the CHILD_SAs of the redundant IKE_SA must not be
closed, as you said.

I hope Tero, Pasi or same IKEv2 guru can clarify this :)

-- 
Alejandro Perez Mendez
Pedro J. Fernandez Ruiz

University of Murcia

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec