> >>       /** Initial sequence number */
> >>       uint64_t seq;
> >
> > This may be moved to outbound struct.
> 
> I thought the same.. yet, some say is needed on inbound as well ("to
> know from where to start expecting frames") a.k.a. antireplay
> mechanism.

It is not needed in inbound since the antireplay window will anyway
slide to the correct position when the first packet is received.

Actually, this field is probably not needed in outbound either since
the ESP RFC says (but maybe does not strictly require it?) that
the first ESP packet sent on an SA will have sequence number 1.

So I suppose the initial sequence number field should just be removed
from the param struct.

        Janne


Reply via email to