Subject: RE: [AAA-WG]: FW: IPSec use with Diameter (from the IPSEC WG list)

From: <[email-masked]>
Date: Wed, 8 Dec 2004 09:40:54 +0200

Hi Jari & Bernard,

> > John, do you remember why we put it in this
> > text?

This was written, by Bernard and:

> I don't believe that the text is incorrect.
> 
> While the IKEv1 initiator may know what port the phase I SA is intending
> to protect, the responder cannot know this because that information is not
> included in the IKEv1 phase 1 exchange.  It doesn't matter how many phase
> 1 SAs are brought up between the two endpoints.  The responder has no idea
> what the phase 1 SA is being brought up for, and so is unable to enforce
> different certificate policies based on the (undisclosed) application.
> 
> In phase 2 the information is available, but by then it's too late.

As I remember, this was the point of the text, so I also don't think that the
text is incorrect.

John

---

From: Jari Arkko <[email-masked]>
Date: Wed, 08 Dec 2004 13:17:15 +0200

> As I remember, this was the point of the text, so I also don't think that the

Scott, do you have something to add to the comments from
Bernard? Based on the information, do you still think the
text should be corrected. If so, how?

--Jari