rfc9611v3.txt		rfc9611.txt
	skipping to change at line 352 ¶		skipping to change at line 352 ¶
	to the SAD requires access to the key material, whereas updating the		to the SAD requires access to the key material, whereas updating the
	CPU selector on an existing outbound SAs might not require access to		CPU selector on an existing outbound SAs might not require access to
	key material. To support this, the IKE software might have to hold		key material. To support this, the IKE software might have to hold
	on to the key material longer than it normally would, as it might		on to the key material longer than it normally would, as it might
	actively attempt to destroy key material from memory that the IKE		actively attempt to destroy key material from memory that the IKE
	daemon no longer needs access to.		daemon no longer needs access to.
	An implementation that does not accept any further resource-specific		An implementation that does not accept any further resource-specific
	Child SAs MUST NOT return the NO_ADDITIONAL_SAS error because it		Child SAs MUST NOT return the NO_ADDITIONAL_SAS error because it
	could be misinterpreted by the peer to mean that no other Child SA		could be misinterpreted by the peer to mean that no other Child SA
	with a different TSi and/or TSr is allowed either.		with a different TSi and/or TSr is allowed either. Instead, it MUST
			return TS_MAX_QUEUE.
	7. Security Considerations		7. Security Considerations
	Similar to how an implementation should limit the number of half-open		Similar to how an implementation should limit the number of half-open
	SAs to limit the impact of a denial-of-service attack, it is		SAs to limit the impact of a denial-of-service attack, it is
	RECOMMENDED that an implementation limits the maximum number of		RECOMMENDED that an implementation limits the maximum number of
	additional Child SAs allowed per unique TSi/TSr.		additional Child SAs allowed per unique TSi/TSr.
	Using multiple resource-specific child SAs makes sense for high-		Using multiple resource-specific child SAs makes sense for high-
	volume IPsec connections on IPsec gateway machines where the		volume IPsec connections on IPsec gateway machines where the
End of changes. 1 change blocks.
	1 lines changed or deleted		2 lines changed or added
This html diff was produced by rfcdiff 1.48.