Subject: [Ipsec] PFS

From: Alejandro Perez Mendez <[email-masked]>
Date: Fri, 11 Nov 2005 12:52:20 +0100

Hi. I have some troubles understanding how PFS is performed when
proposal has more than one protocol.

What is the desired way to indicate we want to use AH + ESP protocol and
we also want to refresh DH material?
Where we must include the DH_ID transform, in the ESP protocol, in the
AH protocol, in both...?

If a proposal like the following is valid (I suppouse it is), must we
include two KE payloads in the CREATE_CHILD_SA exchange? It is possible?
I suppouse that not but I don't know how perform this funcionability.

PROPOSAL #1---------> PROTOCOL ESP |---------> TRANSFORM ENCR 3DES
          |                        |---------> TRANSFORM ENCR AES256
          |                        |---------> TRANSFORM INTEG SHA1
          |                        |---------> TRANSFORM DH 2
          |                        |       ....
          |            
          |---------> PROTOCOL AH  |---------> TRANSFORM INTEG MD5
          |                        |---------> TRANSFORM DH 1
          |                        |       ....

-- 
Alejandro Perez Mendez <[email-masked]>
Pedro Javier Fernandez Ruiz <[email-masked]>

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec