Subject: dead peer detection

From: Michael Thomas <[email-masked]>
Date: Wed, 15 Aug 2001 12:20:19 -0700 (PDT)

It was brought up at the last IETF that dead peer
detection should be considered by the protocol
upfront. I agree, this would be a very good thing
to nip at the bud, as it were, since this has been
a nagging problem with IKE. I spoke the Bill
Sommerfeld afterward and he mentioned his idea of
using "birth certificates" for IKE. I think that
we can adapt his idea in a pretty straightforward
way for KINK. Namely, we have a pretty good source
of synchronized time from the KDC (needed for
kerberos replay protection). What I'd like to
propose is that we:

1) Add an epoch to the KINK header which is a
   4 byte epoch timestamp which defines the 
   validity epoch of currently instantiated SA
   for a principal

2) That KINK peers MUST record the epoch for
   the principal that instantiates SA's in
   its SADB

3) A KINK peer MUST reap any SA's if it determines
   that the current epoch for a principal is 
   greater than the currently recorded epoch

4) A KINK peer MAY use a notificationless STATUS
   command to determine the peer's epoch

5) A KINK peer SHOULD, upon receipt of IP packets
   with unknown SPI's, try to correlate from the
   SPD which peers might have stale SPI's and
   alert them by sending a STATUS message with
   the current epoch

6) A KINK peer MUST make certain that its local
   time is within the time skew limits imposed
   by Kerberos before setting the current epoch.   

Thus, the normal flow after reboot of Alice where
Bob still has unexpired SPI's would be:

   Alice                   Bob

0) [reboots]

1) <--------------------SPInnn

2) STATUS epoch=new---------->

3) <---------------------REPLY

4) <-------------DELETE SPInnn

5) REPLY--------------------->

[possibly followed by a CREATE, of course]