Subject: [IPsec] question about 2.8.1 simultaneous child SA rekeying

From: Toshihiko Tamura <[email-masked]>
Date: Mon, 18 Jan 2010 19:48:27 +0900

Hi, I want to ask about simultaneous Child SA rekeying 
at section 2.8.1 in IKEv2bis.

I'm sure it is convenient to support this function,
but why is current IKEv2bis draft saying this fucntion
as SHOULD?
-------------------------------
If redundant SAs are created though such a collision, the SA
created with the lowest of the four nonces used in the two exchanges
SHOULD be closed by the endpoint that created it.
-------------------------------
Even if this function is not supported and two new pairs of 
Child SAs are created, there is no problem.
Should this be regraded as optional?
I think " ... the two exchanges MAY be closed by..." is better.

Are there any discussions about it in the past?

---------
Regards, 
Toshihiko Tamura

---

From: Yoav Nir <[email-masked]>
Date: Mon, 18 Jan 2010 13:00:18 +0200

Hi

> but why is current IKEv2bis draft saying this fucntion

SHOULD means that is is acceptable for an implementation to not do this, provided there is a good enough reason. that it makes your SA database management more complicated is a perfectly acceptable reason. In fact, the draft is full of comments about minimal implementations, and how you need to make allowances for them.

In this case, I think SHOULD is preferable to MAY because it is definitely better to delete the redundant SA rather than keep it.

Yoav