19.6 Summary
Key management sockets are used to communicate
SAs to the kernel, key management daemons, and to other security
consumers such as routing daemons. SAs can be installed statically
or dynamically via a key negotiation protocol. Dynamic keys can
have associated lifetimes; when the soft lifetime is reached, the
key management daemon is informed. If an SA is not replaced before
the hard lifetime is reached, the SA can no longer be used.
Ten messages are exchanged between the process
and kernel on key management sockets. Each message type has
associated extensions, some required and some optional. Each
message that is sent by a process is echoed to all other open key
management sockets, removing any extensions containing sensitive
data.
|
