Subject: Re: [IPsec] ikev2 algorithms, Initiator choice preferred over responder ?

From: Michael Richardson <[email-masked]>
Date: Wed, 24 Oct 2012 19:50:06 -0400

Kalyani Garigipati (kagarigi) <[email-masked]> wrote:
    KG> If the initiator proposes three algorithms say alg1, alg2. Alg3
    KG> for encryption in SA1.  And responders choice is in the order as
    KG> alg3,alg2,alg1, then finally in SA_INIT response what should be
    KG> sent as the algorithm.

Why would the responder reply with three choices?  The spec doesn't say that.
It's not a negotiation.  If the responder has a preference, it should
simply state that one preference in the reply.

    KG> From the RFC I felt that it is the initiator choice that should
    KG> be given preference and so responder MUST send alg1 in response.
    KG> Or is it that responder MUST be given preference and it MUST
    KG> send alg3 in response ?

The responder is free to answer whatever it thinks it should based upon
local policy.

{in the future, please create a new email rather than replying (and
including) another thread in your email.  This matters to the list
archives.  I've removed the in reply-to, references, etc. headers from
this email, and I'm including your email below for context}

From: "Kalyani Garigipati (kagarigi)" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Wed, 24 Oct 2012 04:23:14 +0000
x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-19298.000
x-tm-as-result: No--56.144900-8.000000-31
x-tm-as-user-approved-sender: No
x-tm-as-user-blocked-sender: No
Subject: [IPsec] ikev2 algorithms,
	Initiator choice preferred over responder ?
Sender: [email-masked]

Hi ,

If the initiator proposes three algorithms say alg1, alg2. Alg3 for encryption in SA1.
And responders choice is in the order as  alg3,alg2,alg1, then finally in SA_INIT response what should be sent as the algorithm.

From the RFC I felt that it is the initiator choice that should be given preference and so responder MUST send alg1 in response.
Or is it that responder MUST be given preference and it MUST send alg3 in response ?

I could not locate any paras in RFC which gives clear guidelines on this.
Please let me know if anything like this is already mentioned otherwise I think it should be added in clarifications.

Regards,
Kalyani

-- 
Michael Richardson
-on the road-