Subject: (IPng 7503) Re: Last Call: IPv6 Jumbograms to Proposed Standard

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 10 May 1999 21:30:44 -0400

In message <[email-masked]>, Craig Metz writes:
> In message <[email-masked]>, you write:
> >Cast our (Mentat) lot in with the incremental IPSec header approach,
> >when applying our policy we build a complete packet from the innermost
> >IPSec header on out.
> >
> >I guess we know MSR, KAME, NRL, and Mentat approaches now.  I read the
> >score as 3-1 so far.
> >
> >Anyone else ready to close down or open the gap further?
> 
>   Marc, I think you're doing it the same way NRL does it, which makes things
> 2-2.
> 
>   Of course, I'll also observe that this and many other problems and
> ambiguities with the IPsec specs are a direct result of the design-by-
> democracy approach. A dictatorial edict that we aren't supporting bump-in-the
> -
> wire and we're modelling the assembly of the headers a certain way would solv
> e
> the problem.
> 
>   In practice, though, I don't think either method of assembling the packet
> within the stack necessarily precludes writing the bits with the appearance
> that they were assembled the other way. For example, I can build a two-pass
> mechanism that lets me figure out what the total length is, then put that
> length in all the AHs' pseudo-headers. Similarly, the KAME or MSR people coul
> d
> build a mechanism that inserts the running "virtual length" into the pseudo-
> header.
> 
>   Hmm. Hmm... pseudo-headers... bump-in-the-wire... I smell another reason wh
> y
> I don't like bumps in the wire.

Bump in the wire is fine -- it's AH that's the problem.  The problems
with ambiguities and infelicities in the spec go back at least to July '95,
when (based on work by David Wagner and myself) I posted an analysis
showing that everything in the IP header either couldn't be protected by
AH or didn't need to be.  I was outshouted.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------