[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: reserving some SAIDs
"Donald E. Eastlake 3rd (Beast)" says:
> To my mind, any complete IP security proposal must make it possible to
> send an isolated datagram without end to end set up. This sort of
> thing is the only way I can see to achieve that.
You have to exchange packets with KDCs or key servers to get keys, so
you are already experiencing some traffic overhead. SAID setup can
likely be accomplished with the exchange of one datagram -- this is
hardly high overhead, especially since a SAID is typically a fairly
long lived thing compared to the length of the exchange.
The model, as I understood it originally, was that SAIDs were assigned
by the receiver in any way the receiver saw fit. Is there a really
good reason to abandon this?
Perry
References: