Re: IKE-SA Deletion

["O. Kim" <okim@nist.gov>]

Charlie_Kaufman@notesdev.ibm.com wrote:
> 
> Thank you for the careful reading. The spec is ambiguous. What I had
> in
> mind was that the old IKE SA delete itself as a last act after the new
> 
> one is acknowledged at both ends, thus not needing to specify an
> SPI in the delete. If after the new SA has been
> in place long enough that the two
> ends can be confident that no messages are "in flight", the new SA
> deletes itself, I believe no messages can be lost.
> 
> Does this sound reasonable? If so, I can tighten the language.
> 

Thank you for the response.
Deletion of the old IKE SA would work fine as you explained.
So, I assume that all the child SAs from the old IKE SA are 
transfered to the new IKE SA when the negotiation is complete.


I would like to ask another question:

After the new IKE SA inherits all the child SAs from the old SA, 
how are the message IDs assigned to those child SAs handled?  
Should the original message IDs continue to be used or 
new message IDs from the new IKE SA should be reassigned to 
those child SAs?

If the original message IDs of the old child SAs are retained,
the conflict of message ID between two (one of the old child SAs and
a newly created IKE message) could occur (may have the same message ID).
It may not happen in a real world, but it could happen in theory.
This may affect interoperability in the future.

Okhee
NIST