TS updates in MOBIKE

Narayanan, Vidya writes:
> RFC4555 only allows updates to tunnel endpoint addresses and not
> selectors, etc.

Yes, as that was outside the charter of the mobike.

> Does anyone know why TS updates are not permitted?

It is already done by the IKEv2 protocol, with fast and efficient
exchange called CREATE_CHILD_SA... I.e. if you need it simply, create
new SA with new traffic selectors, and delete the old one.

> If MOBIKE allowed what an SA rekey would allow, what is the problem?

All traffic going through the SA would usually stop, as it would not
know it needs to change the IP addresses, thus it would still be using
the original addresses, and it wouldn't fit to the new SA.

I.e. as the idea is that the for example TCP streams running inside
the IPsec SA using mobike, keeps exactly same IP addresses all the
time, so the TCP do not notice the movement at all. When outer
addresses change, the inner addresses stay same, and TCP will only see
those inner addresses it will stay happy. If those inner addresses
would change then TCP streams running on old addresses would be broken
and connections would be lost unless the TCP stack was also modified
to update the addresses.

So in mobike case there is no need to update the inner addresses, and
if someone makes some real world scenario where such thing is needed
CREATE_CHILD_SA will solve the problem for him...
-- 
[email protected]