Subject: [IPsec] Identities in the draft-ietf-ipsecme-ikev2-resumption

From: Tero Kivinen <[email-masked]>
Date: Tue, 18 Nov 2008 22:18:28 +0200

Why does the resumption has the IDi and IDr payloads? I think it
would be easier to take them directly from the ticket, thus why are
they transmitted in the IKE_SESSION_RESUME case? What happens if the
IDi sent does not match the one in the ticket? Changing the IDr on the
fly for existing IKE SA requires the responder side to redo all policy
lookups, i.e. it can not just assume that policy lookup done when the
IKE SA was originally created is ok, and reuse those.

I would remove both of them from the IKE_SESSION_RESUME exchange. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec