Subject: RE: alternative to user-to-user Kerberos in KINK

From: "Walker, Jesse" <[email-masked]>
Date: Tue, 21 Nov 2000 08:11:58 -0800

Mike,

How, when, and if they choose one is precisely the issue. This was something
left unspecified in the interaction between IKE and IPsec, and as a result
vendors implemented conformant but non-interoperable solutions to this
problem.

-- Jesse

-----Original Message-----
From: Michael Thomas [mailto:[email-masked]]
Sent: Tuesday, November 21, 2000 7:55 AM
To: [email-masked]
Cc: Jan Vilhuber; Derek Atkins; Medvinsky, Sasha (SD-EX); 'Michael
Thomas'; [email-masked]'
Subject: Re: alternative to user-to-user Kerberos in KINK 

I guess I don't quite grok the dilemma here. Initiator and
responder only matter when setting up/tearing down the
SA. Though perhaps not optimal, there shouldn't be a
problem having two SA's with the same flow spec between
two hosts -- they just needs to chose one. Assuming
that either party can tear down an existing SA (which
now that I think about it may not work in the current
draft), you have the situation where either side can
manage the SA's any way they see fit.

What am I missing?

	Mike

Bill Sommerfeld writes:
 > > It might also be worthwhile to do what IKE failed to do, which is to
spell
 > > out re-keying behaviour. If we spell out that the original initiator
needs to
 > > be the one to reinitiate a re-key, then problems won't arise.
 > 
 > How can that possibly work in a non-VPN, non-connection-oriented
 > scenario?  Does the initiator *always* recreate an expiring SA, just
 > in case the peer might want to send something in the future?  
 > 
 > Do you engage in some sort of layering violation, peeking into TCP to
 > see if there are still open connections or tracking connection state
 > in the IP layer?
 > 
 > Or do you not care about long-lived connections, and let them drop if
 > the initiator doesn't have the session up?
 > 
 > I'm not happy with any of these alternatives.. the responder must be
 > able to turn around and reinitiate back to the initiator..
 > 
 > 					- Bill
 >

---

From: Michael Thomas <[email-masked]>
Date: Tue, 21 Nov 2000 08:25:32 -0800 (PST)

Jesse,

Correct me if I'm wrong, but this sure looks like
it's out of the scope of the keying protocol per
se. It seems like it would be better to have a BCP
or something with base IPsec which defines what
the expected behavior ought to be when you have 
two SA's with the same flow spec.

	 Mike