Subject: [IPsec] Issue #132: Should NO_ADDITIONAL_SAS cover rekeying IKE SAs?

From: Paul Hoffman <[email-masked]>
Date: Sun, 17 Jan 2010 08:09:46 -0800

In section 1.3 at the end there is text talking about the NO_ADDITIONAL_SAS. The current text is in the generic CREATE_CHILD_SA section thus it covers all 3 use cases for CREATE_CHILD_SA (creating new IPsec SAs, rekeying old IPsec SAs and rekeying IKE SA). The text there is written to cover only new IPsec SAs, but I think it should also cover rekeying IKE SA cases (section 4 conformance requirements makes it quite clear you can return NO_ADDITIONAL_SAS to any CREATE_CHILD_SA exchange including IKE SA rekey).

This means the text should be changed from

The responder sends a NO_ADDITIONAL_SAS notification to indicate that a CREATE_CHILD_SA request is unacceptable because the responder is unwilling to accept any more Child SAs on this IKE SA. Some minimal implementations may only accept a single Child SA setup in the context of an initial IKE exchange and reject any subsequent attempts to add more.

To

The responder sends a NO_ADDITIONAL_SAS notification to indicate that a CREATE_CHILD_SA request is unacceptable because the responder is unwilling to accept any more Child SAs on this IKE SA. This notify can also be used to reject IKE SA rekey. Some minimal implementations may only accept a single Child SA setup in the context of an initial IKE exchange and reject any subsequent attempts to add more.

--Paul Hoffman, Director
--VPN Consortium