Re: The remaining IKEv2 issues - #64

[Charlie_Kaufman@notesdev.ibm.com]

jpickering@creeksidenet.com wrote:
> I must have missed the resolution on issue 64, can someone remind me of
> the resolution
> and rationale?

The issue was that people were concerned about how an implementation could
know which SA was being rekeyed when a rekey request arrived. In the past,
I had assumed that they would know because the traffic selectors would
match the traffic selectors on the replaced SA. But recent discussions have
allowed for the possibility of multiple SAs with the same traffic selectors
for playing games with QOS and such.

The proposed solution was to include the SPI of the rekeyed SA in the
request to create a new SA, so there would be no ambiguity. It might also
help with the race conditions that can produce duplicate SAs and the
"continuity across rekeying" issue raised by Nicolas Williams. I added an
additional field to the Create_Child_SA exchange to carry the SPI.

      --Charlie