Re: [Hipsec] One HIP session for multiple flows, or one per flow?

Derek Fawcus wrote:
> My reading of the HIP specs suggests that one session (and SA pairs)

I don't quite understand your concept of flows and sessions. It would help if you would define them or be otherwise more specific.

If your concern is related to traffic classification, I would really recommend using the IPv6 flow label for that. In the IPv4 space, I think that SPI based traffic classification is probably not that good an idea. It creates overloaded semantics, and I don't like that.

Right now the HIP design assumes that you have only one pair of SAs between any hosts. However, I think we have to rethink that in the case the hosts have multiple interfaces. The different paths may have very different latencies and bandwithds, making it hard to deal with the replay protection windows. Thus, it looks like that we will need at least an SA per interface.

Based on that, it might be OK to create even more SAs. However, I'd like to see a compelling reason for that. Furthermore, I don't want to complicate the architecture nor the implementation too much. We are still very early in terms of what is the right final architecture, and keeping things simple at this stage probably pay off later.

--Pekka Nikander