RE: why the SAs are unidirectional

[Paul Koning <pkoning@equallogic.com>]

Excerpt of message (sent 18 February 2002) by Andrew Krywaniuk:
> At this point, it just comes down to what you want to name things. In IPsec,
> an SA is unidirectional object with a 32 bit id, so we're stuck with that.
> Since IKE does all its operations on pairs of SAs, it is very easy to create
> a "Bidirectional SA" abstraction that has two 33 bit ids.

Radia brings up a good point, though.  Yes, the fundamental construct
in IPsec is an SA, which is unidirectional, so they are created in
pairs to make a bidirectional channel.

Unfortunately, this is a somewhat messy graft on top of the basic
mechanism.  The protocol really treats each SA as separate, and the
fact that the pairs need to go together is something that requires
constant care and attention and lots of ugly code in IKE.

Compare with SSL, where the bidirectional channel is a fundamental
construct, not a kluge patched on top of unidirectional channels.

	   paul