Re: [Hipsec] some comments for mm-03: CLOSE vs. UPDATE

Hi,

I just want to say that I agree with Pekka that using the CLOSE message for 
closing something else than the whole HIP association is a bad idea. IMHO the 
semantics of CLOSE and UPDATE are different. UPDATE means that you are 
updating something and still want to continue using the previously created 
HIP association. CLOSE means that you want to end the communication, you 
don't want to send anymore anything using the existing HIP association.

  Regards,
    Jan

On Monday 10 April 2006 06:37, Pekka Nikander wrote:
> [Answering bit-by-bit as most probably I won't have time to go
> over all related messages at this point of time.]
>
> >>> The SAs are closed as defined as in <xref="hip-base"> in the general
> >>> case. As such, closing of the SAs causes all of the SAs to be closed
> >>> also in multihoming scenarios. A host MAY add an ESP_INFO
> >>> parameter to
> >>> a CLOSE message to signal that a specific SA is to be close. The
> >>> CLOSE-ACK message should also include the same ESP_INFO
> >>> parameter. In
> >>> the ESP_INFO parameter, the old SPI corresponds to SA to be
> >>> removed. The new SPI and keymat index are set to zero.
> >>
> >> I do not necessarily agree with this, and would like to hear other
> >> opinions.  CLOSE should close all security associations; if a
> >> specific
> >> SA is to be closed while others remain open, it should be possible
> >> to do
> >> so through the UPDATE protocol.
> >
> > So, there seems to be some redundancy with CLOSE and UPDATE. In
> > fact, I'd
> > say that the CLOSE could be replaced with UPDATE as it implements
> > only a
> > subset of UPDATE. Petri, Pekka, others - comments?
>
> IIRC, CLOSE was added fairly late in order to allow the _HIP_
> association to be cleanly torn down.  I think Erik Nordmark suggested
> adding it.
>
> I don't think it is a good idea to use CLOSE for closing SAs, or for
> any other purpose than closing the who HIP SA.  If I understand
> correctly the text above, you Miika are suggesting to use CLOSE to
> close only specific ESP SAs but not the HIP association.  That sounds
> like a pretty bad idea to me, confusing the semantics of CLOSE.  But
> perhaps I don't understand what you are suggesting, Miika?

_______________________________________________
Hipsec mailing list
Hipsec@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/hipsec