Re: why the SAs are unidirectional

[Dan Harkins <dharkins@tibernian.com>]

  Yes and every time you've mentioned it people have pointed out how
that wouldn't work, the last time being the compare-jfk-sigma.txt
thread of early December last year.

  Dan.

On Tue, 19 Feb 2002 09:12:53 +0200 you wrote
> 
> > Unfortunately, this is a somewhat messy graft on top of the basic
> > mechanism.  The protocol really treats each SA as separate, and the
> > fact that the pairs need to go together is something that requires
> > constant care and attention and lots of ugly code in IKE.
> 
> Which is why it shouldn't have tried that in the first place. As I
> have said several times, IPSEC would work just fine if key negotiation
> just negetiated a key for unidirectional SA. Very simple compared to
> the current mess.
>