Subject: [IPsec] Issue #15: Message ID reset to 0 after IKE SA rekey

From: Yaron Sheffer <[email-masked]>
Date: Tue, 3 Mar 2009 20:18:25 +0200

2.2. Use of Sequence Numbers for Message ID

The Message ID is a 32-bit quantity, which is zero for the IKE_SA_INIT messages (including retries of the message due to responses such as COOKIE and INVALID_KE_PAYLOAD {{ Clarif-2.2 }}), and incremented for each subsequent exchange.

Tero:

Add text:

The Message ID is reset to zero also after IKE SA rekey for the new IKE SA.

Paul: Not done. This is interesting, but should be discussed on the list.

---

From: Joy Latten <[email-masked]>
Date: Wed, 11 Mar 2009 17:06:51 -0500

On Tue, 2009-03-03 at 20:18 +0200, Yaron Sheffer wrote:
> The Message ID is a 32-bit quantity, which is zero for the IKE_SA_INIT
> messages (including retries of the message due to responses such as
> COOKIE and INVALID_KE_PAYLOAD {{ Clarif-2.2 }}), and incremented for
> each subsequent exchange. 
> 
> Tero:
> 
> Add text: 
> 
That paragraph has another sentence "Rekeying an IKE SA resets the
sequence numbers." Perhaps the above and this could be
combined. Something like:

Rekeying an IKE SA resets the sequence number counter to zero for the
new IKE SA. 

regards,
Joy