Re: [IPsec] WG adoptation call for draft-smyslov-ipsecme-ikev2-aux-02

[Tobias Heider <[e-mail]>]

>>> I would think it quite differently. Each protocol extension just puts
>>> payloads in the IKE_SA_INIT and once that one becomes too big, the
>>> IKE daemon starts to split it up in an IKE_SA_INIT and IKE_INTERMEDIATE.
>>> This document defines what goes into IKE_SA_INIT, so the rest (eg new
>>> stuff) ca ngo into IKE_INTERMEDIATE.
>>>
>> I like that idea actually. It would be nice though to have some fixed
>> order for
>> additional payloads, as we always had a fixed order for expected payloads.
> IKEv2 has no restrictions on payloads order.
Right. It would have to have some if it was working the way Paul said
though,
because you would have to make sure at least SA, KEx, and Nx stay in the
IKE_SA_INIT
message or otherwise you can't use SK in the IKE_INTERMEDIATE.