Subject: Error in ips-security-07

From: Paul Koning <[email-masked]>
Date: Wed, 23 Jan 2002 16:22:47 -0500

Page 12 of the security draft says:

   If an IKE implementation receives a Phase 1 Delete message for a
   Phase 1 Security Association bound to one or more sessions, then it
   SHOULD delete the associated IKE Phase 2 security associations.

This directly contradicts the rules in RFC 2408 and 2409.  For
example, consider the description of PFS in section 8 of RFC 2409.  In
that discussion, the Phase 1 SA is deleted when the Phase 2 exchange
is complete.

The text in the security draft is based on a mistaken assumption.  In
fact, sessions are not bound to Phase 2 SAs in the first place -- only
to Phase 2 SAs.  Phase 2 SAs are not dependent on a particular Phase 1
SA, and in particular the deletion of the Phase 1 SA that was used to
do a Quick Mode exchange has no effect on the Phase 2 SAs established
by (completed) QM exchanges on that SA.

The paragraph I quoted should be deleted.

      paul

---

From: Paul Koning <[email-masked]>
Date: Wed, 23 Jan 2002 19:10:17 -0500

Excerpt of message (sent 23 January 2002) by KRUEGER,MARJORIE (HP-Roseville,ex1):
> Was this a typo?:
> > to Phase 2 SAs. 
>       ^^^^^^^
> Did you mean Phase 1 SAs?  Otherwise this sentence doesn't make sense?

Oops, yes, that's a typo, but not that way around.  Here's what I
meant:

  The text in the security draft is based on a mistaken assumption.
  In fact, sessions are not bound to Phase 1 SAs in the first place --
  only to Phase 2 SAs.

        paul