Re: same SPI/different exchange

[Bill Sommerfeld <sommerfeld@East.Sun.COM>]

> Bill Sommerfeld writes:
>  > > What is the intended behavior of IKE if you
>  > > receive a proposal for a SPI which already exists?
>  > 
>  > If this happens, the peer is probably buggy ..
> 
>    Really? Doesn't this happen as a natural consequence of
>    retransmissions? 

I'd hope that replay detection would prevent that case ..

>  > This sounds like the robust thing to do; I'd want to be careful to
>  > ensure that the old and new instances were treated as "different"
>  > (from the point of view any caching which might be going on..)
> 
>    Right. They could change proposals, etc too.

different proposals, different keys, reset sequence number space,
etc.,

---

Follow-Ups:

• RE: same SPI/different exchange
• From: "Awan Kumar" <awank@future.futsoft.com>

References:

• Re: same SPI/different exchange
• From: Michael Thomas <mat@cisco.com>

---

• Prev by Date: Re: same SPI/different exchange
• Next by Date: Re: IPSec performance statistics
• Next by thread: AH length field, and derivation of name "SKEYID"
• Index(es):
  • Main
  • Thread