Scope of SA change in design document..

Mohan Parthasarathy writes:
> I think there is a bigger issue here. You can't have
> one SA and have multiple flows/packets going over
> different paths because if their path charecterestics
> are different, the replay check would drop the
> packets. Unless ESP can maintain per-address
> sequence numbers, how this would be possible.
> Perhaps this could be mentioned as a design point.
> I don't remember whether this was discussed before
> or not.

Actually that is not problem with issue 8. The issue 8 is about moving
only part of SAs created between two hosts. One SA always will use
exactly one address pair regardless of issue 8. Our charter do rule
out load balancing, i.e. using multiple addresses at the same time for
single IPsec SA is explicitly ruled out for the group.

We do already offer a way for the host to create separate group of SAs
which are moved separately from each other, i.e. applications can
create multiple IKE SAs, and create the IPsec SAs to the IKE SA having
similar IPsec SAs. I.e. if you have 3 different groups of IPsec SAs
wanting to have different charasteristics from the interfaces uses,
you can create 3 IKE SAs and create those IPsec SAs inside each of
those IKE SAs. Then you have 3 groups (IKE SAs) which you can
separately move from one address pair to another.

You can even move the IPsec SAs from one group to another, by
recreating the IPsec SA in diffenet IKE SA and then deleting the old
IPsec SA from old IKE SA.

The problem with ESP sequence numbers comes only if we try to do
load-balancing, i.e. use multiple different ip-addresses for the SAME
IPec SA at the same time. 
-- 
[email protected]