Re: [IPsec] I-D Action: draft-nir-ipsecme-cafr-00.txt

[Yoav Nir <[e-mail]>]

On Aug 14, 2013, at 12:52 PM, Valery Smyslov <[e-mail]> wrote:

> Hi Yoav,
> 
> isn't it better to do Child SAs movement in a separate Informational Exchange,
> rather than in IKE_AUTH?
> 
> Pros:
> 1. No race conditions

You would then have three operations that you need to do:
 a. Re-authenticate - create a new IKE SA
 b. Move the IPsec SAs
 c. Delete the old IKE SA

Each of (b) and (c) could be done by any peer, not necessarily the same one that did (a). If we get a DELETE before all the IPsec SAs were transferred, some SAs could be deleted, or worse - they could be deleted on only one peer.

> 2. No additional complication to already over-complicated IKE_AUTH

It adds one more thing for the peers to do during IKE_AUTH, but it doesn't make a difference if the extra thing is within IKE_AUTH or immediately after. If the issue is the length of the packet, I believe we are already solving this.

> 3. More generic solution, so can be used in other situations,
>   for example in case IKA SA is cloned (draft-mglt-ipsecme-keep-old-ike-sa).

Interesting point. That draft does not, in fact, state what happens to the child SAs. Since the old SA is kept, I guess they remain, and when the old IKE SA does eventually get deleted, the child SAs are also deleted. Nor does it help to specify that they move: the new IKE SA might get deleted first.

> Contras:
> 1. Extra round trip.
> 
> Regards,
> Valery Smyslov.