Subject: [IPsec] Who is the Initiator of rekeying CHILD SA?

From: Jaemin Park <[email-masked]>
Date: Fri, 21 May 2010 00:37:08 +0900

This can be the ridiculous question, but there exist some confusion in the
context of initiator of CHILD SA around me.

Suppose that host A and host B exist.

Host A initiated the exchanges (IKE_SA_INIT & IKE_AUTH) to establish the IKE
SA and CHILD SA with host B. (In this case, Host A is the Initiator and Host
B is responder.)
Then, host B (the responder of previous IKE exchange) initiated the CHILD SA
rekeying (CREATE_CHILD_SA) with host A.

In this case, who is the Initiator of rekeying CHILD SA? host B? or host A?
According to the RFC4306, I think host B is the initiator of CHILD SA.
Therefore, the fields such as SPIi, Ni and TSi should be the value of host
B. Am I right?

---

From: "Kalyani Garigipati (kagarigi)" <[email-masked]>
Date: Fri, 21 May 2010 11:28:23 +0530

Hi Jaemin,

You are right, Since B is initiating the exchange the values of SPIi,
Ni, and TSi will be the values of host B

Regards,

kalyani

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Jaemin Park
Sent: Thursday, May 20, 2010 9:07 PM
To: [email-masked]
Subject: [IPsec] Who is the Initiator of rekeying CHILD SA?

This can be the ridiculous question, but there exist some confusion in
the context of initiator of CHILD SA around me.

Host A initiated the exchanges (IKE_SA_INIT & IKE_AUTH) to establish the
IKE SA and CHILD SA with host B. (In this case, Host A is the Initiator
and Host B is responder.)

Then, host B (the responder of previous IKE exchange) initiated the
CHILD SA rekeying (CREATE_CHILD_SA) with host A.

In this case, who is the Initiator of rekeying CHILD SA? host B? or host
A?

Therefore, the fields such as SPIi, Ni and TSi should be the value of
host B. Am I right?