Subject: RE: AH and flow label

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 10 Sep 2004 11:28:49 -0400

Francis, 

I agree with the drawback you see and it's not ideal.
But I also think the whole flow label story was inconsistent
and we finally have concensus on how we want to use it. 
Given the fact that it is immutable, it makes a lot of 
sense to protect it. 

The benefit depends on the application. In cases where 
the value of the flow label is used for any type of decision
making related to routing or QoS (in an end host) it is very
important to make sure that it was not modified by MITM. 
Today there is no way of knowing this. 

I have several ideas in mind for using the flow label.
One of those was published in the flow movement draft. So
if the above is too abstract please see draft-soliman-mobileip-flow-move
for an example. 

Hesham

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]
Sent: Friday, September 10, 2004 11:12 AM
To: Soliman, Hesham
Cc: Brian Haberman; [email-masked]
Subject: Re: AH and flow label 

 In your previous mail you wrote:

   I agree with Brian. I'd like to see it protected. 
   
=> can you explain what should be the benefits? because today I can see
only one major drawback: gratuitous incompatibility with current
implementations.

[email-masked]

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Sat, 11 Sep 2004 11:30:06 +0200

=> this is something we should not reproach the ipsec WG for...

=> this is a "make it prettier" weak argument, i.e.,
we have to assume our previous inconsistencies.

=> as only the destination can check the ICV, the application must
both be at the destination, not on an intermediate node, and need
a per packet protection of the flow label. I don't know such application,
in fact in general there is even no API to get the received flow label!

=> many of us have, but not one implying the usage of AH.
In fact the last time AH was nearly deprecated we didn't find
convincing cases where the extra protection provided by AH
was really an advantage...

=> I've looked at the (expired) document: there is no security considerations
so no recommendation to use AH. And when I try to build an argument
I get two cases:
 - end-to-end flow movement (i.e., with routing optimization): the classic
   5-tuple works and is even better because for instance it supports wirdcards.
 - home agent flow movement: the home agent is an intermediate node...

Thanks

PS: perhaps James Kempf (who supports you) has a good argument?