Added a note about DH/keymat lifecycle for custom implementations

2012-04-17 10:02:21 +02:00
parent a59a03670b
commit d0d600e1ef
1 changed files with 6 additions and 1 deletions
@@ -40,7 +40,12 @@ struct keymat_t {
 	 *
 	 * The diffie hellman is either for IKE negotiation/rekeying or
 	 * CHILD_SA rekeying (using PFS). The resulting DH object must be passed
-	 * to derive_keys or to derive_child_keys and destroyed after use
+	 * to derive_keys or to derive_child_keys and destroyed after use.
+	 *
+	 * Only DH objects allocated through this method are passed to other
+	 * keymat_t methods, allowing private DH implementations. In some cases
+	 * (such as retrying with a COOKIE), a DH object allocated from a different
+	 * keymat_t instance may be passed to other methods.
 	 *
 	 * @param group			diffie hellman group
 	 * @return				DH object, NULL if group not supported