Questions about OSPF v3 security draft

[Mike Fox <[e-mail]>]

Regarding 
http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-07.txt, 
and the previous drafts, a couple of questions have come up in our shop. 

1) Section 7, 2nd paragraph says "the implementations MUST use manually 
configured keys with same SA for inbound and outbound traffic (as shown in 
figure 3).  I assume the "same SA" MUST rule applies to multicast traffic 
only and not unicast traffic. This is because an SA is defined as an SPI, 
security protocol (AH or ESP), and destination IP address. For unicast 
addresses, by definition there will be as many SAs as there are unicast 
destination addresses. Therefore, I don't think it is possible to apply 
this MUST rule given the current IPSec definition (RFC 2401 section 4.1) 
of an SA for unicast. Assuming the intention of the draft was to apply 
only to multicast and given the number of potential SAs carrying unicast 
traffic, it would seem that using IKE to setup the SAs dynamically would 
be a reasonable alternative to manual keying. 
 
2)Section 9, 2nd paragraph discusses setting up a "secure IPSec channel 
dynamically once it acquires the required information".  Since this 
traffic is unicast only, IKE could easily set up the required SAs without 
knowing the specific IP addresses in advance. Creating SAs dynamically do 
not fit easily within scope of manual SA functional capabilities. Why not 
use IKE for this traffic? Is this an acceptable option? 

Mike

-----------------------------------------------------------------------
Enterprise Network Solutions
-----------------------------------------------------------------------
Research Triangle Park, NC  USA