Re: Issue #82: Creation of SAs -- clarifications

[Stephen Kent <kent@bbn.com>]

At 18:23 +0300 10/14/03, Tero Kivinen wrote:
>Parsing this text took quite a long time for me. I finally think I
>managed to understand what it is trying to say, but I think the actual
>text added to the final document must explain the things more clearly.

we'll try to rephrase, to make this complex topic clearer. I admit it 
was badly done in 2401 and we're trying to do a better job this time.

>
>So my understanding of the issue is that this changes the text which
>says that we can create SAs selectors based on the packet or based on
>the SPD to text which says that we can create SA selectors based on
>the packet or based on the SPD, or something between.

the goal is to allow an SAD entry and an SPD cache entry to be 
created based on selector values from the packet that triggered the 
creation of the SA. This facility was supposed to be described in 
2401, but I think it was even less clear there :-)

>I.e in addition to only take selectors from the packet implementations
>are allowed to expand them towards to the SPD selectors as much as
>they like.

I don't understand these words.  Let me try again.

For each selector in the SPD, in addition to the literal values that 
define a match, we have defined special values, e.g., ANY and 
OPAQUE. We're saying there is another special value, PFP (populate 
from packet) that indicates the SPD entry matches any value for this 
selector, but wants a new SA created with the value from that 
selector field in the packet header to be used in creating the new SA.

>Orginal case a) allowed only very specific SA selectors based on the
>packet itself. The original case b) takes the SA selectors from the
>SPD. The current IKEv2 approach is that we take the selectors from the
>packet and select the SPD which matches to them and then create SA
>that is either that SPD or any subset of it, as long as the packet
>itself fits to that subset.

IKE is invoked with a set of SPD selector values. In the case of a 
PFP selector, what IKE sees is the SPD entry with the selector field 
extracted from the packet, as opposed to a value from the SPD.


Does this help?

Steve