Subject: [IPsec] draft-ietf-ipsecme-ikev2-resumption-00.txt SPI values

From: Tero Kivinen <[email-masked]>
Date: Tue, 18 Nov 2008 00:24:11 +0200

The draft says that ticket has SPI values, but those are not used, so
I am bit confused what SPI values is used in which places.

1) When the client does IKE_SESSION_RESUME what SPI values he uses in
   the HDR? New SPIi, and SPIr=0? Or old SPIi and SPIr?

2) From the test it seems that when creating new keying material the
   new SPIi and SPIr are used, so I assume the IKE_SESSION_RESUME
   request needs to use SPIi = new, and SPIr = 0, and then
   IKE_SESSION_RESUME reply will use same SPIi, and allocate new SPIr
   and those are used when creating the keying material?

3) Why are the SPIi and SPIr needed on the ticket at all?
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 18 Nov 2008 01:33:16 +0200

Hi Tero,

Thanks for your review!

The wording in Sec. 4.5 is not very clear on this. So here goes:

There are two pairs of SPIs. The old one is the IKE SA that was interrupted.
SPIi and SPIr of this SA are included in the (opaque) ticket to help the
gateway associate the ticket with a particular IKE state. The ticket is
opaque, so if you don't want to do it, nobody will notice :-)

The other pair of SPIs is generated during IKE_SESSION_RESUME, and as you
suggest, HDR for the initiator has new SPIi, and SPIr=0.

A related correction: Sec. 4.5 says "the sequence numbers are reset to 0".
But in reality they should be 0 for the IKE_SESSION_RESUME messages, and
increment from there.

Thanks,
	Yaron

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tero Kivinen
Sent: Monday, November 17, 2008 16:24
To: [email-masked]
Subject: [IPsec] draft-ietf-ipsecme-ikev2-resumption-00.txt SPI values

The draft says that ticket has SPI values, but those are not used, so I am
bit confused what SPI values is used in which places.

Scanned by Check Point Total Security Gateway.
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec