Subject: Text suggestion on computing keymat for rekey

From: "[email-masked]" <[email-masked]>
Date: Tue, 25 Mar 2003 13:24:15 -0500

To compute keymat for any SA, both sides need to agree on which side is 
initiator.
While this is obvious for new SAs, the text is unclear about rekeys,  eg 
if  the original
responder is the initiator of a rekey, which end is considered initiator 
of the of the
new SA for puposes of computing keymat? After some SF hallway 
discussions, the
general impression I got was that there is some value to keeping the 
original initiator
as initiator of the rekeyed SA, (ie for management purposes this 
approach doesnt allow
a rekey to hide which end was original initiator). As such, I propose 
adding the
following text to the end of section 2.8:

"For purposes of computing keying material for the rekeyed SA, the 
original initiator
of the SA is to be considered initiator of the rekeyed SA."

Jeff

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 25 Mar 2003 14:19:20 -0500

> of the SA is to be considered initiator of the rekeyed SA."

I may well have been part of the same hallway discussion.  One of the
other conclusions that this group came to was that it was somewhere
between extremely helpful and absolutely necessary to add an attribute
in the negotiation which specifically called out *which* SA was being
rekeyed/replaced.  (All you'd need is the SPI of the previous SA).

I hope this also isn't controversial.

						- Bill

---

From: Michael Richardson <[email-masked]>
Date: Wed, 26 Mar 2003 08:08:49 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Bill" == Bill Sommerfeld <[email-masked]> writes:
    Bill> I may well have been part of the same hallway discussion.  One of the
    Bill> other conclusions that this group came to was that it was somewhere
    Bill> between extremely helpful and absolutely necessary to add an
    Bill> attribute 
    Bill> in the negotiation which specifically called out *which* SA was being
    Bill> rekeyed/replaced.  (All you'd need is the SPI of the previous SA).

  Hugh Redelmeier proposed the term "channel identifier" to represent a
long-lived number that uniquely identifies the communications. It does not
change when things are rekeyed.

  I was thinking that 32-bits of low-grade random number was enough for both
ends to "announce", with the long-term number being their concatenation.
(Likely, lower IP address end first, since this may survive Init/responder
roles easily)

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [