Sec. 2.6:

Unlike ESP and AH where only the recipient's SPI appears in the header of a 
message, in IKE the sender's SPI is also sent in every message. Since the SPI 
chosen by the original initiator of the IKE_SA is always sent first, an 
endpoint with multiple IKE_SAs open that wants to find the appropriate IKE_SA 
using the SPI it assigned must look at the I(nitiator) Flag bit in the header 
to determine whether it assigned the first or the second eight octets.

Tero:

Our implementation originally only checked its own SPI half, and didn't verify 
that the other ends SPI half didn't change. This was found out in the interop, 
and we fixed it to check the other ends SPI also, but I wonder should we say 
one way or the other here? Also what SPI should the response have, i.e. the 
SPIs from the request, or the SPIs from the original IKE SA creation. I think 
it might be easier to just say, that implementations can use their own SPI to 
find the IKE SA data, but MUST also check that the other ends SPI matches the 
SPIs stored with IKE SA data.

Paul: Not done. This is interesting, but should be discussed on the list.

_______________________________________________
IPsec mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipsec

Reply via email to