Re: SOI QUESTION: 4.7 Authenticated informational messages

[Jan Vilhuber <vilhuber@cisco.com>]

On Thu, 27 Jun 2002, Theodore Ts'o wrote:

>
> Please discuss and answer this question:
>
> 4.7 Authenticated informational messages
>
> 4.7.A) Does SOI need to provide authenticated informational messages
> after an IKE SA has been set up?

Yes.

>  (What sort of informational messages
> might be needed?

As Tero pointed out, SCTP address additions may be useful. There's
been long discussion about expanding (and contracting) the policy that
the SA applies to. That discussion is no doubt affected by the speed
of rekeying (is it cheaper to negotiate a new SA to expand and
contract the policy? Or is it cheaper to send a notification to expand
and contract?).

>  Do they need to be protected in a different key than
> the SA key?)
>

They should be protected under the SA management channel.

jan


> Implications from the Scenarios:
>
> [none]
>

 --
Jan Vilhuber                                            vilhuber@cisco.com
Cisco Systems, San Jose                                     (408) 527-0847

http://www.eff.org/cafe