Subject: [Ipsec] Number of Proposals in IKE_SA_INIT exchange for IKE_SA and first CHILD_SA ??

From: khan wadood <[email-masked]>
Date: Fri, 13 Aug 2004 09:33:15 +0100 (BST)

hi,

How may proposals Initiator will send in the first
xchange i.e., IKE_SA_INIT. If Initiator wants to make
two SAs i.e., IKE_SA and first CHILD_SA(piggybacked
with IKE_SA) having same cryptographic suite.

Or we can say
A  single proposal for IKE_SA is sufficed for first
CHILD_SA. If CHILD_SA uses the same cryptographic
suite as of IKE_SA.

Any comments/answers will be highly appreciated.

wadood

________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 13 Aug 2004 13:11:49 +0300

> with IKE_SA) having same cryptographic suite.

Depends on the policy. The CHILD_SA parameters does not affect to
that, as CHILD_SA proposals are sent inside the another SA payload
inside the IKE_AUTH exchange (SAi2, SAr2).

SAi1, and SAr1 are only used for IKE_SA, and the SAi1 can have
multiple proposals, if those are acceptable, and SAr1 will always have
one selected proposal. 
-- 
[email-masked]