How IPSEC phase II session keys are different after rekey

[mshboul89]

IPSEC Phase II session keys are derived by the below formula, where SKEYIDd comes from phase I. When phase II performs rekey while phase I is still up/same, how are the new keys different from the previous ones ? The parameters of the formula seems to be the same:

KEYMAT = HMAC (SKEYIDd,protocol|SPI|NonceI|NonceR)

[Mohammed al Baqari]

This formula is used to establish additional SAs while the 1st SA is
online. For example your initial ping is from 10.1.1.1 to 10.2.2.2. An
ISAKMP and IPSEC SA will be established. This will use SKEYID_d, SKEYID_e
and SKEYID_a. When you start a second ping from 10.3.3.3 to 10.4.4.4 which
matches another traffic selector, your formula is used to calculate KEYMAT
for the 2nd SA.

When rekaying based on IPSEC SA timer, the key will be same (unless PFS is
enabled). Keys will change only after ISAKMP SA rekey. For this reason the
default timer for ISAKMP SA is less than that for IPSEC SA. This is
completely resolved in IKEv2

[mshboul89]

"When rekaying based on IPSEC SA timer, the key will be same (unless PFS is
enabled). "
--> so what's the benefit of rekey if the keys (session keys) will be the same ? are you sure about this ?

"Keys will change only after ISAKMP SA rekey. For this reason the
default timer for ISAKMP SA is less than that for IPSEC SA. This is
completely resolved in IKEv2"
--> default timer of ISAKMP SA is by default more than IPSEC ( 24 hours vs 1 hour)

[Mohammed al Baqari]

SKEYs will change with ISKAMP SA rekey not IPSec SA rekey. If you want to
enable on IPSec rekey then enable PFS.