Subject: [core] draft-ietf-core-coap-09 - IPsec

From: Thomas Fossati <[email-masked]>
Date: Sat, 14 Apr 2012 22:18:29 +0200

Admittedly, the following is just my eye-parser running -pedantic; anyway here it is.

Section 10.2. says:
"The use of IPsec between CoAP end-points is transparent to the application layer and does not require special consideration for a CoAP implementation."

The total transparency of IPsec to the application layer is not completely true.

Though there is no unified IPsec policy management interface, IPsec implementations tend to provide their own interfaces to allow applications to play with the SPD on a per socket basis -- usually via setsockopt.

So, perhaps it'd be better making explicit that each CoAP implementation, depending on the policy management interface offered by the underlying IPsec stack, may want to dynamically instruct the SPD to setup a security association for a specific flow.
Or something along these lines.