Subject: Re: Ordered and unordered SPD in draft-ietf-ipsec-rfc2401bis-01

From: Stephen Kent <[email-masked]>
Date: Tue, 2 Mar 2004 16:24:35 -0500

Mike,

Thanks for the feedback.  We will go back and try to clarify the 
description in the places you noted.  We may need to refer to the SPD 
and the decorrelated SPD, with the former as the default unless 
otherwise qualified, to avoid this confusion.

Steve

---

From: Greg Troxel <[email-masked]>
Date: 02 Mar 2004 19:34:10 -0500

From: "Michael Roe" <[email-masked]>

  In draft-ietf-rfc2401bis-01, the description of the processing
  model is very confusing. The problem is that is keeps switching
  between two different representations of the SPD:

   (a) An ordered SPD, which may contain overlapping entries
   (b) An unordered SPD, which must not contain overlapping entries

I had a similar reaction on reading the draft, but was lame about
commenting.

Since decorrelation is "just" an optimization, my (unconsidered)
preference is to have all the descriptions be in terms of the ordered
SPD, perhaps with 'the packet is looked up in the SPD' explained once,
and then that definition simply used.  The decorrelation presentation
could then be descriptive, with the authoritative rules for lookup be
in terms of the ordered SPD.

There is another, more subtle issue, which is that any time the SPD is
changed any data structures derived from the SPD should be updated.
While this typically course includes computing a new decorrelated SPD
to enable fast lookups, it may also be necessary to revisit extant SAs
in implementations that omit SPD lookups when a packet matches an SA,
since an SA match may no longer indicate reliably that the packet is
allowed by the SPD.  Decorrlating the SPD doesn't _cause_ this issue,
but I believe it makes it harder to see.

-- 
        Greg Troxel <[email-masked]>

---

From: Stephen Kent <[email-masked]>
Date: Tue, 2 Mar 2004 20:28:41 -0500

>in terms of the ordered SPD.

the problem is that our new model for processing flow uses caches, 
which require a decorrelated SPD.

Steve