Re: combining SA proposals in IKE [was: Some questions]

[Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us>]

> I'm not so sure I see a need for requiring that the SPIs be unpredictable.

THis isn't an IKE concern, it's an overall *system*-level concern.

AH/ESP SPI's should be unpredictable so that off-path
clogging/denial-of-service attacks aren't ridiculously easy.. it's
much more efficient to discard a packet with a unknown SPI than to
verify the MAC on one with a valid SPI...

				- Bill

---

References:

• Re: combining SA proposals in IKE [was: Some questions]
• From: Daniel Harkins <dharkins@cisco.com>

---

• Prev by Date: Authentication Only Bit
• Next by Date: Policy question
• Next by thread: RE: [Karen Seo: Thomas Narten -- clarification, etc.]
• Index(es):
  • Main
  • Thread