[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
IPSec policy
It looks like the policy descriptors have been designed from the initiator
perspective, rather than the responder perspective. When the initiator wants
to figure out the policy, it goes to the policy database, and grabs the
appropriate proposals, etc. When the responder gets this incoming request, it
should also go to its own policy database. The proposal, from a responder
perspective, can be lined up along side the initiator proposal, and somehow you
figure out which is the most appropriate (I say that somehow you figure it out
because the results could change depending on whether you consider the
initiator proposal to take precendence over the responder or not: is this worth
standardizing?).
Anyway, it's highly unlikely that the proposal will match, down to exact expiry
values. I think the responder proposal must have a range for attributes that
are "rangeable." E.g., it may make sense to have a policy that says the RC5
encryption alg will be accepted with any key size between 512 and 1024, rather
than code up a separate proposal for each acceptable key length value.
The responder proposal is obviously useful only for responding. The initiator
proposal does not have a place for ranges in the format of the proposal.
Vach Kompella
IBM Corp.
Network Security Product Development
kompella@us.ibm.com
Ph.: (919) 254-7281
Fax: (919) 254-4239