4

I am learning IPSec. My class notes define a security association as a one way relationship between sender and receiver that (1) affords security for traffic flow and (2) is identified by the destination address in the IP header, the SPI and the enclosed extension header (AH or ESP). Wikipedia describes SA as a "logical group of security parameters that enable the sharing of information to another entity." After reading the wikipedia article, I imagine SAs as a set of security parameters.

What is a security association within the context of IPSEC?

Improve this question

1 Answer 1

Reset to default
7

"Security Association" is the big name for whatever a machine A needs to know in order to send IPSec-protected packets to a machine B. Within the memory of A is the information: "with B, packets must use this type of IPSec header (AH or ESP) with these cryptographic algorithms and that specific key". By definition, when machine A talks to machine B and uses IPSec for such communication, then there must be some convention between A and B about how this will be done. "Security Association" is the defined terminology to describe that convention. How a security association is established is another matter -- it can be manual configuration by sysadmins on both machines, or done dynamically with a protocol such as ISAKMP.

Improve this answer
1
  • Sorry to dig up this very old thread, but could you clarify whether A needs one or two S.A. in order to communicate with B ?
    – Arthur Attout
    Jun 7, 2018 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .