Subject: [IPsec] Comment on "suspicious message" handling in RFC 4306 2.21

From: Keith Welter <[email-masked]>
Date: Wed, 24 Sep 2008 17:25:12 -0700

>From RFC 4306 Section 2.21
   A node receiving a suspicious message from an IP address with which
   it has an IKE_SA MAY send an IKE Notify payload in an IKE
   INFORMATIONAL exchange over that SA.  The recipient MUST NOT change
   the state of any SA's as a result but SHOULD audit the event to aid
   in diagnosing malfunctions.  A node MUST limit the rate at which it
   will send messages in response to unprotected messages.

I assume "suspicious message" means the sort of message the would result 
in the recipient sending INVALID_SPI or INVALID_IKE_SPI.  I'm wondering 
how much value is added by sending the notification using an existing 
IKE_SA as opposed to using the unprotected one-way notification.  In the 
case of INVALID_IKE_SPI, the unprotected notification actually has the 
advantage of carrying the unrecognized SPIs in the IKE header whereas the 
protected notification would not.  Furthermore, if INITIAL_CONTACT is 
working properly it seems that the case of having an existing IKE_SA with 
which to send the notification should not even occur.  The only advantage 
I can see to sending the protected notification is that the recipient 
should not start a liveness exchange.  If the value of the MAY in the 
excerpt above is indeed small, perhaps it should be striken for the sake 
of simplicity.

Keith Welter
IBM Enterprise Networking Solutions
1-415-545-2694 (T/L: 473-2694)
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec