Subject: [IPsec] INVALID_KE_PAYLOAD reply example

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 17:03:47 +0300

> >  C.4.  CREATE_CHILD_SA Exchange for Creating or Rekeying CHILD_SAs
> >
> >     request             --> [N(REKEY_SA)],
> >                             [CP(CFG_REQUEST)],
> >                             [N(IPCOMP_SUPPORTED)+],
> >                             [N(USE_TRANSPORT_MODE)],
> >                             [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
> >                             [N(NON_FIRST_FRAGMENTS_ALSO)],
> >                             SA, Ni, [KEi], TSi, TSr
> >
> >     response            <-- [CP(CFG_REPLY)],
> >                             [N(IPCOMP_SUPPORTED)],
> >                             [N(USE_TRANSPORT_MODE)],
> >                             [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
> >                             [N(NON_FIRST_FRAGMENTS_ALSO)],
> >                             SA, Nr, [KEr], TSi, TSr,
> >                             [N(ADDITIONAL_TS_POSSIBLE)]
> 
> And here:
> 
>      error case           <-- N(error)
> 
> 
> 
>      invalid ke payload	 <-- N(INVALID_KE_PAYLOAD)
> 
>      next request with    --> [N(REKEY_SA)],
>      new ke payload using     [CP(CFG_REQUEST)],
>      group given by	     [N(IPCOMP_SUPPORTED)+],
>      invalid ke payload	     [N(USE_TRANSPORT_MODE)],
>      notify		     [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
> 			     [N(NON_FIRST_FRAGMENTS_ALSO)],
> 			     SA, Ni, [KEi], TSi, TSr
>      (response would be same as in normal case).
> 			    
> ===Done. Well, did the first two. The last is no different than
> the original request. I suspect you wanted to change something
> in it; if so, please re-submit.

In the last example the actual payloads were same, only difference was
the text which said "next request with new KE payload using group
given by INVALID_KE_PAYLOAD notify", i.e. after INVALID_KE_PAYLOAD
request you retry using exactly same payloads as before, but select
different group for KE packet. Perhaps my description for the request
was not clear enough. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 23 Sep 2008 09:32:27 -0700

>different group for KE packet. Perhaps my description for the request

If the format is the same, I don't see value in repeating it in this 
appendix. If it is not clear in the body that you send the normal 
format, we can add words there about it.

--Paul Hoffman, Director
--VPN Consortium