Subject: [IPsec] ikev2bis issue #181: Section 2.4 unclear on Child SA failing

From: Tero Kivinen <[email-masked]>
Date: Thu, 1 Apr 2010 15:11:39 +0300

Paul Hoffman writes:
> Section 2.4 says "If Child SAs can fail independently from one
> another without the associated IKE SA being able to send a delete
> message, then they MUST be negotiated by separate IKE SAs". It is
> not clear what this means. Does it apply to implementations?

Yes.

> If so, how can an implementation know whether or not the first
> clause is true?

The implementor should know that. I.e. if the IPsec SAs are divided to
multiple crypto chips, and those chips can fail independently causing
all IPsec SAs on that chip to disappear but leaving IPsec SAs on other
chips intact, then those groups of IPsec SAs cannot be negotiated with
same IKE SA. 

> I propose removing the sentence, or greatly clarifying it.

For me the current text is very clear, and I do not see how we can
clarify greatly. This issue usually only affects implementations where
there are multiple subsystems which can fail independently from each
other. If the only failure model is that the whole device
crashed/rebooted etc then this text does not apply, as all IPsec SAs
(and IKE SAs) disappear at the same time. 
-- 
[email-masked]

---

From: David Wierbowski <[email-masked]>
Date: Thu, 1 Apr 2010 09:28:40 -0400

> (and IKE SAs) disappear at the same time.

I disagree with the Tero's comment statement that the text is very clear,
I've never understood exactly what the statement  meant until I read the
example that Tero provided.  Based on that I would at least recommend
changing the text as follows:

If sets of Child SAs can fail independently from one
another without the associated IKE SA being able to send a delete
message, then each set of Child SAs MUST be negotiated by separate IKE SAs.

It might even be approbate to add Tero's example:

For example if sets of IPsec SAs are associated with different crypto
chips, and
each chip can fail independently causing all IPsec SAs associated with the
chip
to disappear then each set of IPsec SAs should be negotiated with a
different IKE SA.

Dave Wierbowski