RE: why the SAs are unidirectional

["Hilarie Orman, Purple Streak Development" <hilarie@xmission.com>]

> You really wouldn't want to create a true unidirectional SA, since it
> is hard to tell if it's a black hole. So IPsec SAs get created in pairs, 

It depends on what you mean by "an SA".  It's no more strange than UDP
and port numbers which are also "unidirectional" channels, and
sometimes they are useful as singletons.  The naming convention makes
IPsec channels naturally unidirectional because the SPI is only unique
for the receiver.  That turns out to be useful, because the sending
and receiving algorithms can be different and because it's easy to
define asymmetric protocol use, such as for multicast.

Hilarie