Re: Do we actually need dynamic ports?

[Tero Kivinen <kivinen@ssh.fi>]

vilhuber@cisco.com (Jan Vilhuber) writes:
> This is no different than creating a second SA, I suppose. You want
> traffic for the FTP data channel? Create a new SA for
> it. Alternatively, and this is what Pyda's and my draft does, pass an
> indicator that identifies the previous SA, and ADD to it. Saves
> memory, at almost no additional cost.

Why have a special case for ADD and DELETE, why not simply renegotiate
new SA with new set of selectors (i.e add new selectors, remove the
ones you do not want), and when that new SA is ready, delete the old
SA. I.e simply make ADD and DELETE to be rekey of the existing SA.

For IKEv1 you could not do that, as there was no way to express the
set of selectors, but with TS we can do that, so now that is an
option.
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/