While I am aware that the SPI (along with destination IP and protocol) is used to uniquely identify an incoming SA on a peer, for the life of me I am not able to understand how that particular SPI value is determined and agreed upon by both peers during IKE phase 2 message exchanges, for both the incoming and outgoing SA that are established on each of them. I have come across sources stating the below:
The SPI is a 32-bit number that is chosen by the initiator to uniquely identify the outgoing IPSec SA that is generated as a result of this negotiation in its database of security associations. The responder, upon seeing the SPI, makes sure that it is not the same as one of the SPIs it is using and starts using it for its incoming IPSec SA. It also proposes an SPI for its outgoing (and the initiator's incoming) SA, which the initiator agrees to after checking.
The above scheme seems more like a trial and error than a negotiation. Logically, I would expect the responder to chose a value for the SPI that is not currently in use for its incoming SA, and send that over to the initiator to record in its SAD and encode the same in all future AH/ESP payloads it sends to the responder over this SA. My questions are as below:
- Is the above description actually how it takes place?
- If yes, what happens in case the responder receiving the SPI from the initiator finds out that the SPI value is already in use?