On Oct 21, 2022, at 03:37, Steffen Klassert <steffen.klass...@secunet.com> wrote: > > > Another possibility would be to use the same keymat on all > percpu SAs
You cannot do that. You need to ensure unique IVs for AEAD so you would need to subdivide the IV space. You would also still reach max operations on these SAs on different times AND things like FIPS puts an operational max count on the key usage which you can’t do if the key is used by multiple different states. Using different real child SA’s was needed to ensure the cryptographic security properties. Paul _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec
