[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: New SPI when renegotiate keys?
> I know when ISAKMP renegotiates a new key with a remote partner that the
> documentation says this creates a new SA. Does this new SA have to have
> a different SPI than the previous one?
I believe so. And if I'm wrong, I'd like to see my reasons for why
countered.
> If so, why?
Because IP has no delivery guarantees, and changing the keys on an existing
SA will scramble packets that arrive AFTER the rekeying, but were
encrypted/authenticated BEFORE the rekeying. Hey, it's IP, anything can
happen.
Consider the following SA:
A -> B, AH HMAC-MD5, SPI = 0x84001100, key = <foo>
So I receive some packets for SA {B, 0x84001100}. Suddenly I perform an
ISAKMP regnegotiation and change the key from <foo> to <bar>.
But say before that happened, a packet left A. Let's say that the packet got
caught in a routing loop while the ISAKMP exchange took place. Suddenly this
old packet arrives at B, and the SA lookup succeeds. But now, the key is
different so it won't authenticate.
Dan
Follow-Ups:
References: