Subject: RE: AH and flow label

From: "Bound, Jim" <[email-masked]>
Date: Fri, 10 Sep 2004 11:37:21 -0400

Francis,

The flow label should not be part of the ICV because it is permitted to
be rewritable enroute as long as it is delivered in tact E2E.  I say
keep as it is today.  No other comment.

Thanks for asking,
/jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Francis Dupont
> Sent: Friday, September 10, 2004 4:50 AM
> To: [email-masked]
> Subject: AH and flow label
> 
> Here is a message from Steve Kent who is updating the RFC 
> 2402 "IP Authentication Header (AH)" about the flow label status.
> I have put it in this list for people interested by IPsec but 
> who have no enough time to read the mailing list...
> To summary the question is:
> 
> Is the [ipsec] WG comfortable with the status quo, i.e., NOT 
> including the flow label in the ICV [integrity check value], 
> despite the fact that it is immutable?
> 
> [email-masked]
> 
> PS: of course my opinion is we have to keep the status quo 
> and the decision is in the scope (i.e., hands?) of the ipv6 WG.
> 

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Fri, 10 Sep 2004 20:42:43 +0300 (EEST)

> keep as it is today.  No other comment.

But it won't be possible to verify the AH enroute in any case (or are
you assuming that those who do the rewriting have the keying material
-- I'd be surprised to see such deployments), so it would still be
rewritable as long as it's reversed.

This is actually better because it would ensure that the flow label
would actually be reversed if rewritten (otherwise, some deployments
might be tempted to just rewrite it) because not doing so would fail
end-to-end AH.

But I see the problem with breaking existing implementations (and I
don't know how commonplace this is, and don't know the
interoperability assumptions), so I don't have strong preference on
this either way.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Stephen Kent <[email-masked]>
Date: Fri, 10 Sep 2004 12:56:20 -0400

>keep as it is today.  No other comment.
Jim,

If it is delivered with the same value as when it was sent, then it 
can be included in the ICV computation. Note that the requirement for 
inclusion is that a value either be immutable OR be predictable at 
the receiver. So, what you indicated above would not be a basis for 
excluding the flow label.

Steve

---

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 10 Sep 2004 14:57:08 -0400

> keep as it is today.  No other comment.

nodes in the middle are also unlikely to be in a position to verify
the ICV.

if it is, in fact, guaranteed to be put back to the way it started on
the other end, then whether or not it is covered by the ICV should not
matter to networks which want to change it in the middle.

						- Bill