[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: anti-replay protection without IKE
> If IKE isn't being used, should IPSEC hosts allow replay protection? RFC
> 2401 hints that replay checking shouldn't be done for manual SAs,
> presumably on the theory that manual keys are likely to be long-lived.
> However, there are applications that use a different key management
> protocol because (for various reasons) IKE is inappropriate. Simply as a
> matter of convenience, such applications may use the manual keying
> interface, especially if only one key management daemon can exist on a
> system. Should (or SHOULD) implementations permit such applications to
> request replay checking?
Absolutely! For most unicast traffic, there's no reason NOT to use replay,
except for maybe manual keying.
The cases where replay protection is destructive all involve the potential
for multiple independent senders of traffic. The most common case of this is
multicast traffic. Less common is a case where a unicast SA has no source
address selector associated with it, and multiple senders use the same
unicast SA to send traffic to a single unicast destination.
Dan
References: