Subject: [IPsec] optional SAs

From: "Paul Moore" <[email-masked]>
Date: Mon, 12 Jan 2009 07:37:25 -0800

(Transport mode)

Is there a generally accepted requirement for and definition of optional SAs?

Linux has 'use' - this means (as far as i can see) that if racoon can negotiate an SA then the kernel will use it, otherwise the kernel behaves as though there was no SPD set and let the traffic flow.

Windows has the same thing (I think its the same).

But is this individual implementations deciding that this is a nice to have or is there a spec for it somewhere? Is it a required feature for conformance?

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Dan McDonald <[email-masked]>
Date: Mon, 12 Jan 2009 10:41:03 -0500

> Is there a generally accepted requirement for and definition of optional

I didn't think so, but maybe 4301 has text for it.  Another example is 4301's
"populate from packet" which is the formalization of the around-since-NRL
"Unique SA" concept.

> Linux has 'use' - this means (as far as i can see) that if racoon can
> negotiate an SA then the kernel will use it, otherwise the kernel behaves
> as though there was no SPD set and let the traffic flow.

"use" is another NRL-original concept.  Such a concept requires cooperation
from key management on the initiating/transmitting side (or connection
latching once an inbound packet has been accepted), but on the
responder/receiving side is straightforward.

> But is this individual implementations deciding that this is a nice to have
> or is there a spec for it somewhere? Is it a required feature for
> conformance?

Unless it's been added in 4301, I don't believe it's required.

Dan