Subject: AW: Interim AH Scheme

From: Euchner Martin <[email-masked]>
Date: Wed, 28 Mar 2001 11:10:53 +0200

all,

I'm not an H.248 expert. But if it is true, that several H.248 transactions can be concatenated together (I believe that H.248 uses the term Message for the concatenated result), then I assume, that the mentioned proposal is a clarification and a security improvement.

Kind Regards,

Martin Euchner.
-----------------------------------------------------------------------
| Dipl.-Inf.                     Phone: +49 89 722 55790
| Martin Euchner                 Fax  : +49 89 722 46841
| Siemens AG
| ICN M NT 5                     mailto:[email-masked]
|                                mailto:[email-masked]
| Hofmannstr. 51                 Intranet: http://intranet.icn.siemens.de/marketing/network_technology/security/pki.htm
| D-81359 Muenchen               Internet: http://www.siemens.de
| __________________
| Germany     
-----------------------------------------------------------------------

	-----Ursprüngliche Nachricht-----
	Von:	Christian Groves [SMTP:[email-masked]]
	Gesendet am:	Mittwoch, 28. März 2001 06:28
	An:	[email-masked]
	Cc:	[email-masked]
	Betreff:	Re: Interim AH Scheme

	G'Day all,

	This sounds reasonable to me as Implementors' guide editor but I'm not a
	security expert. Anybody have problems making this change?

	Christian

	Giri Rajasekhar Saladi wrote:
	> 
	> Hi List,
	>         In the following extract from RFC 3015, shouldn't the "the entire
	> transaction" (indicated below by ^^^^^^^^^) be "all the transactions
	> (concatenated) in the message", as we may have more than one transaction
	> in a message.
	> 
	> 
	> 10.2 Interim AH Scheme
	> 
	>                                 ...
	> 
	> As an interim solution, an optional AH header is defined within the
	>    H.248 protocol header. The header fields are exactly those of the
	>    SPI, SEQUENCE NUMBER and DATA fields as defined in [RFC2402]. The
	>    semantics of the header fields are the same as the "transport mode"
	>    of [RFC2402], except for the calculation of the Integrity Check value
	>    (ICV). In IPsec, the ICV is calculated over the entire IP packet
	>    including the IP header. This prevents spoofing of the IP addresses.
	>    To retain the same functionality, the ICV calculation should be
	>    performed across the entire transaction prepended by a synthesized IP
	>                     ^^^^^^^^^^^^^^^^^^^^^^
	>    header consisting of a 32 bit source IP address, a 32 bit destination
	>    address and a 16 bit UDP destination port encoded as 10 hex digits.
	>    When the interim AH mechanism is employed when TCP is the transport
	>    Layer, the UDP Port above becomes the TCP port, and all other
	>    operations are the same.
	> --
	> Regds,
	> Giri
	> 
	> --
	> 
	> S.G.Rajasekhar
	>              Member Technical Staff,
	> Networking Systems Lab,
	> HCL Technologies Ltd,
	> 51, JN Road,
	> Ekkadu Thangal,
	> Guindy Industrial Estate,
	> Chennai -600 097.
	> Tel:2334174/2334181
	> Fax:2334256
	> Email: [email-masked]

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Wed, 28 Mar 2001 09:53:25 -0500

I think the point is correct.  The purpose of the header is to protect the
message, not just the first transaction in it.

> -----Original Message-----
> From: Christian Groves [mailto:[email-masked]]
> Sent: Tuesday, March 27, 2001 11:28 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Interim AH Scheme
> 
> 
> G'Day all,
>

---

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 29 Mar 2001 09:53:53 -0500

I designed the "Interim AH" mechanism, and am embarrassed to note that
it should have been "message" and not "transaction".  Basically, you want
to cover all the bytes in the packet.

Brian