Subject: [IPsec] Clarification on Protocol ID

From: Soo-Fei Chew <[email-masked]>
Date: Wed, 6 Aug 2008 09:43:47 -0700

Hi

Can you clarify about the Protocol ID as follows:

When the initiator 'retries' IKE_SA_INIT with a COOKIE Notify Payload (with responder supplied cookie data), should the Protocol ID be 0 or 1? In this case, it does involve an existing SA as far as the initiator is concerned.

--SNIP rfc 4306 Section 3.10 ---
o  Protocol ID (1 octet) - If this notification concerns an existing
      SA, this field indicates the type of that SA.  For IKE_SA
      notifications, this field MUST be one (1).  For notifications
      concerning IPsec SAs this field MUST contain either (2) to
      indicate AH or (3) to indicate ESP.  For notifications that do not
      relate to an existing SA, this field MUST be sent as zero and MUST
      be ignored on receipt.  All other values for this field are
      reserved to IANA for future assignment.
--SNIP rfc 4306 Section 3.10 ---

Thanks,
SooFei
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Thu, 7 Aug 2008 23:10:12 +0300

Hi SooFei,
 
Take a look at RFC 4718, Section 7.8.
 
Best regards,
Pasi

________________________________

	From: [email-masked] [mailto:[email-masked]] On Behalf Of ext Soo-Fei Chew
	Sent: 06 August, 2008 19:44
	To: [email-masked]
	Subject: [IPsec] Clarification on Protocol ID

	Hi

	Thanks,

	SooFei

---

From: Soo-Fei Chew <[email-masked]>
Date: Thu, 7 Aug 2008 14:13:11 -0700

Hi

If combine RFC4718 7.8 and the following statements in RFC 4306, then it seems to indicate that a Protocol ID of 1 with an empty SPI should never exist!!

3.10.  Notify Payload
...
   o  Protocol ID (1 octet) - If this notification concerns an existing
      SA, this field indicates the type of that SA.  For IKE_SA
      notifications, this field MUST be one (1). ...

   o  SPI Size (1 octet) - Length in octets of the SPI as defined by the
      IPsec protocol ID or zero if no SPI is applicable.  For a
      notification concerning the IKE_SA, the SPI Size MUST be zero.

7.8.  Protocol ID/SPI Fields in Notify Payloads

   Section 3.10 says that the Protocol ID field in Notify payloads "For
   notifications that do not relate to an existing SA, this field MUST
   be sent as zero and MUST be ignored on receipt".  However, the
   specification does not clearly say which notifications are related to
   existing SAs and which are not.

   Since the main purpose of the Protocol ID field is to specify the
   type of the SPI, our interpretation is that the Protocol ID field
   should be non-zero only when the SPI field is non-empty.

   There are currently only two notifications where this is the case:
   INVALID_SELECTORS and REKEY_SA.

Thanks,
-SooFei
________________________________
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, August 07, 2008 1:10 PM
To: Soo-Fei Chew; [email-masked]
Subject: RE: [IPsec] Clarification on Protocol ID

Hi SooFei,

Best regards,
Pasi

Thanks,
SooFei

---

From: <[email-masked]>
Date: Fri, 8 Aug 2008 01:57:21 +0300

Yes -- draft-hoffman-ikev2bis clarifies that none of the currently defined notifications would use Protocol ID 1.
 
Best regards,
Pasi

	From: [email-masked] [mailto:[email-masked]] On Behalf Of ext Soo-Fei Chew
	Sent: 08 August, 2008 00:13
	To: Eronen Pasi (Nokia-NRC/Helsinki); [email-masked]
	Subject: Re: [IPsec] Clarification on Protocol ID

	Hi

	3.10.  Notify Payload

	...

	Thanks,

	-SooFei

	Hi SooFei,

	Best regards,

	Pasi

		Hi

		Thanks,

		SooFei

---

From: Soo-Fei Chew <[email-masked]>
Date: Fri, 8 Aug 2008 11:36:27 -0700

Looks like Protol ID of 1 can *never* be used if we follow both RFC 4718 section 7.8 and RFC 4306 3.10, since they contradict each other as follows:

rfc4306
If (ProtoID == 1) then SpiSize == 0

rfc4718
If (ProtoID != 0) then SpiSize != 0
which infers that If (ProtoID == 1) then SpiSize != 0 <-- this contradicts 4036

-SooFei

Sent: Thursday, August 07, 2008 3:57 PM

Best regards,
Pasi

3.10.  Notify Payload
...

Thanks,
-SooFei

Hi SooFei,

Best regards,
Pasi

Thanks,
SooFei