[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
correction on SPIs
It turns out that my memory is not to be trusted (not entirely surprising :-).
The NRL software does indeed have separate number spaces for SPIs and so
an AH session and an ESP session to the same destination with the same
SPI value will indeed be different Security Associations in the Key
Engine.
IMHO, this is how all implementations ought to work. Unless there is
WG consensus to the contrary, I intend to make this separation
very clearly required in the revision to RFC-1825 when I edit it
in a few months. This should not be hard to implement and makes things
much simpler for the key mgmt mechanisms.
Ran
rja@cisco.com
Follow-Ups: