Subject: [IPsec] Original initiator (was: Some (ok, a lot) comments to ikev2bis)

From: <[email-masked]>
Date: Tue, 14 Oct 2008 13:56:16 +0300

Paul Hoffman wrote: 

> >      * I(nitiator) (bit 3 of Flags) - This bit MUST be set in
> >        messages sent by the original initiator of the IKE_SA and
> >        MUST be cleared in messages sent by the original responder.
> >        It is used by the recipient to determine which eight octets
> >        of the SPI were generated by the recipient.
> 
> Add clarification here, that the Inititor bit does not change even
> if IKE SA is rekeyed (regardless who rekeys it).
> 
> ===Done.

Hmm -- is this consistent with Clarif-5.9? (included in the end 
of Section 2.8)

Tero seems to be proposing that rekeying can't change who the
original initiator is, but that's not what we decided back in 2005
when discussing what to say in Clarif-5.9. This did cause some 
terminology challenges in MOBIKE (see RFC 4555, Section 1.3, 3rd 
paragraph), but in the end, it works either way.

Best regards,
Pasi
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 14 Oct 2008 16:08:22 +0300

> paragraph), but in the end, it works either way.

Ah true, it was that way around. Forgot that already, but that just
proves the point that we need to mention it here too, as even I
misremembered how it should be... :-)

So the clarification should say that this bit changes to reflect who
initiated the last rekey for the IKE SA. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 14 Oct 2008 07:39:53 -0700

>initiated the last rekey for the IKE SA.

Is that what we actually want? Or do we want to say what Tero proposed (the initiator is always the initiator)?

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 15 Oct 2008 13:08:50 +0300

Paul Hoffman writes:
> Is that what we actually want? Or do we want to say what Tero
> proposed (the initiator is always the initiator)? 

We must keep backward compatibility and this do affect interoperation,
thus we must keep it as it was before. I just remembered that there
had been problems with that bit before, but as I didn't check the
specification for that bit when I wrote those comments, I got it wrong
way around...
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec