Subject: [Ipsec] question regarding rfc 4302-IP Authentication Header

From: Joy Latten <[email-masked]>
Date: Tue, 05 Jun 2007 13:43:06 -0500

I would like to verify that the algorithm specified in rfc4302-IP
Authentication Header, section 2.4 - SPI, is only applicable for IPsec
multicast implementations. Thus, if only unicast implementation, entries
in SAD do not have to indicate what to use for SA lookup. Am I
interpreting correctly?

Regards, 
Joy

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 5 Jun 2007 15:19:44 -0400

>in SAD do not have to indicate what to use for SA lookup. Am I

Section 2.4 of RFC 4302 describes how to do an SPI search for both 
unicast and multicast SAs. In the unicast case the lookup is easy, 
i.e., it is a match in just the SPI (or SPI and protocol), because 
the SPI for each inbound SA is selected to be unique by the receiver 
(or unique per security protocol), hence there is no need to consider 
the S/D Ip addresses in the match.

The SAD DOES have to include the SPI to enable this match, so your 
comment above is not quite right. But, yes, the text says:

If an IPsec implementation supports multicast, then it MUST support
multicast SAs using the algorithm below for mapping inbound IPsec
datagrams to SAs.  Implementations that support only unicast traffic 
need not implement this de-multiplexing algorithm.

I think this text is reasonably clear on the topic.

Steve