Re: IKEv2 SA rekeying - naming an initial SA

[Stephen Kent <kent@bbn.com>]

At 8:39 -0700 8/22/03, Nicolas Williams wrote:
>On Fri, Aug 22, 2003 at 09:12:28AM -0400, Stephen Kent wrote:
>>  what part of "no" do you find puzzling :-)
>
>I didn't insist - I merely pointed out something I thought was ironic.
>
>At least you appear to have some sense of humor :)

I try.

>BTW, this "no" was to "anon IPsec."  I'd still like a session ID bound
>to initial IKE_SA KEs - please don't ignore this.

right.

>If there will never be anon IPsec then the AUTH values will do - but I'd
>like to not discount the possibility that there might be an anon IPsec
>formulation in the future.

Any admin managing an IPsec environment has the ability to issue 
credentials that are effectively anonymous, and that allows the 
effect of anonymous use of IPsec, in a given context.  Unless the WG 
changes direction in a significant way, to support unauthenticated 
IPsec, then it would be inappropriate to use the possibility of this 
change as an input in deciding on how to make a decision re this IKE 
v2 authentication issue.

Steve