Subject: (IPng 7519) Re: Last Call: IPv6 Jumbograms to Proposed Standa rd

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 12 May 1999 19:04:46 -0400

In message <[email-masked]>, Craig Metz writes:
> In message <[email-masked]>, you write:
> >The fields in the header which are protected by AH either (a) can be
> >changed en route and thus need to be excluded from the ICV, or (b) are
> >extremely likely to be constant for the duration of an SA, so it just
> >seems so much simpler to protect them by binding them to the SA (i.e.,
> >drop inbound packets if the header field(s) in question don't match
> >what the SA says it should contain).
> 
>   The latter is a solution that I believe would work. However, (a) that's jus
> t
> not what the IPsec WG came up with (b) please, PLEASE don't open up old wound
> s
> in that WG, it's taken so long to get to this point and (c) IKE is already fa
> r
> too complex, adding this is not going to help.

No one is suggesting, at this date, that the question of AH be reopened.
But some remedy is clearly needed --  there's an interoperability problem
caused by different interpretations of the spec.  You would prefer saying
"no bump in the wire", I'd prefer saying "no AH" -- but realistically,
the answer is going to be a clarification when the IPSEC documents move
to "Draft Standard".  For now, I suggest that someone write up the problem
clearly and send it to the IPSEC list.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------