Subject: CREATE on active SPI

From: Michael Thomas <[email-masked]>
Date: Sat, 25 Aug 2001 14:07:35 -0700 (PDT)

Currently the draft is silent on what the receiver
should do if it receives a CREATE for a SPI which
it already has an active SA. My inclination is to
deem this bogus and return an error (probably via
an appropriate ISAKMP notify payload).

Objections?

		Mike

---

From: Jan Vilhuber <[email-masked]>
Date: Sat, 25 Aug 2001 15:53:36 -0700 (PDT)

> an appropriate ISAKMP notify payload).
It could be that the remote rebooted, and just happened to pick the exact
same SPI it had before reboot (not all THAT unlikely if you have a bad RNG),
So I'd venture the opinio that a CREATE for a SPI we already have should
result in the deletion of the existing one, and a creation of a new SPI..

Of course it could be a retransmission that took a bad turn on the internet
somewhere (and was routed through pakistan or something). Can KINK detect
retransmission without actually decrypting the packet? If so (say via a
sha-hash of the original packet; that's how I detect retransmissions in IOS's
IKE implementation), we can drop retransmissions very fast, and if we STILL
get a create for a SPI you already have it MUST be a different request (since
a retransmission would have been detected via sha-hash)...

Unless you want to include the concept of an INITIAL_CONTACT as in IKE...

jan
 --
Jan Vilhuber                                            [email-masked]
Cisco Systems, San Jose                                     (408) 527-0847