Re: why the SAs are unidirectional

[Markku Savela <msa@burp.tkv.asdf.org>]

> Unfortunately, this is a somewhat messy graft on top of the basic
> mechanism.  The protocol really treats each SA as separate, and the
> fact that the pairs need to go together is something that requires
> constant care and attention and lots of ugly code in IKE.

Which is why it shouldn't have tried that in the first place. As I
have said several times, IPSEC would work just fine if key negotiation
just negetiated a key for unidirectional SA. Very simple compared to
the current mess.