[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ISAKMP DELETE payload
> I think this is an ISAKMP job. IMHO, Oakley is a Key Exchange Protocol
> but deleting an SA is part of SA management, not key exchange. From an
> operational point of view, the SPI's in the msg header will identify the
> ISAKMP SA, which leads to the right hash algorithm and key. So no
> KEP-specific details are needed here. After all, the DELETE and HASH
> payloads are defined by ISAKMP, not OAKLEY.
On the one hand, I understand your viewpoint. On the other, though,
one cannot establish an ISAKMP SA from the details of the ISAKMP draft
alone. One needs a DOI definition, and specific transforms need to
be proposed by the initiator for the ISAKMP SA; those transforms are in
turn defined by the DOI.
It also isn't clear that one would always want to use a HASH payload
to protect the DELETE. A DOI definition could just as well mandate
that the Informational exchange must be encrypted, rather than hashed.
Also, keep in mind that one may be using the Informational exchange to
delete not the ISAKMP SA, but rather some underlying protocol SA, such
as an IPSEC SA. By definition, the details of those protocol SAs are
defined by the DOI, and not in the base ISAKMP document.
-Shawn Mamros
E-mail to: mamros@ftp.com
Follow-Ups: