Subject: [anonsec] rfc2401bis-06: Why there are no names in SAs?

From: pekka.nikander at nomadiclab.com (Pekka Nikander)
Date: Fri, 29 Apr 2005 15:57:55 +0300

[Excuse for cross-posting; followups to ipsec only.]

Folks,

While reading rfc2401bis-06 for considering BTNS, I came up
with one serious architectural question.  At this point of time
I don't know if this really relates to BTNS or not, but it seems
to have some larger relevance in any case.

The essence of this question boils down to the nature of IP
addresses.  While reading rfc2401bis, it becomes apparent that
it is very much build around the model that the IP addresses
used by different hosts are considered to be stable, or at least
divisible into different security classes in a static manner.
While that may be fine for most if not all current purposes of
IPsec, I am afraid that the Internet in general is moving away
from that notion.

However, in addition to the selectors based on this world view,
the SPD and PAD also have now support for "names", mainly
meant to be used in situations where at least one of the IPsec
devices is an end-host (rather than a security gateway).  The
support for these higher-layer, symbolic identifiers seems to
be sufficient for key management and outgoing traffic.  What
seems to be especially good is the use of names in linking PAD
and SPD entries together (end of section 4.4.3.4).

What seems to be missing is support for incoming traffic.
More specifically, what I am missing is either

   a) names embedded in (inbound) SAD entries, or
   b) back pointers from (inbound) SAD entries to
      corresponding SPD entries

If either of them were in place, that would allow incoming
packets to be tagged with names.  Those names could then,
optionally, be available to apps above.

Furthermore, and probably more importantly, tagging
the SAs with names would make it also easier to handle
with potential stale SAs as the SPD is dynamically
changed.

Now, is there a specific reason why the (inbound) SAD
entries are not tagged/linked with their corresponding
SPD entries?

--Pekka Nikander