Subject: Re: a question on SPP draft ...

From: Matthew Condell <[email-masked]>
Date: 25 Apr 2001 12:48:40 -0000

Elwin,

--- Elwin Eliazer <[email-masked]> wrote:
> Do you expect policy server to run the
> decorrelation algorithm? And represent
> policies in decorrelated form?

Yes, the SPP draft requires policy servers to exchange
decorrelated policies.  This is required to allow policies
to be cached.

> The decorrelated representation can
> result in a big exclusion list.
> The implementations i have seen all use
> only ordered policy lists.

The decorrelated representation of a set of policies
can be a bit cumbersome, however, it can relatively easily 
be generated from a list of ordered policies.  Earlier drafts 
that included more details on decorrelation, also included 
one algorithm for decorrelating an ordered list of policies.
I can send out the relevent text about decorrelation, if you'd
find that useful.

Matt

---

From: "Sami Vaarala" <[email-masked]>
Date: Thu, 26 Apr 2001 09:36:03 +0300

Matthew,

> I can send out the relevent text about decorrelation, if you'd

Most IPsec/IKE implementations rely on an ordered list of
IPsec policies for policy matching.  Is there an efficient
method of converting the decorrelated representation into
an (efficient) ordered list, that only requires 'standard'
selectors (ie no exclusion lists or such)?

I think this is very important when considering deployment.

(I haven't read the draft in question, though, so if I am
asking something that is obvious, just let me know.)

-Sami