Subject: Interim AH Scheme

From: Giri Rajasekhar Saladi <[email-masked]>
Date: Tue, 27 Mar 2001 14:52:36 +0530

Hi List,
	In the following extract from RFC 3015, shouldn't the "the entire 
transaction" (indicated below by ^^^^^^^^^) be "all the transactions 
(concatenated) in the message", as we may have more than one transaction 
in a message.

10.2 Interim AH Scheme

				…

As an interim solution, an optional AH header is defined within the
   H.248 protocol header. The header fields are exactly those of the
   SPI, SEQUENCE NUMBER and DATA fields as defined in [RFC2402]. The
   semantics of the header fields are the same as the "transport mode"
   of [RFC2402], except for the calculation of the Integrity Check value
   (ICV). In IPsec, the ICV is calculated over the entire IP packet
   including the IP header. This prevents spoofing of the IP addresses.
   To retain the same functionality, the ICV calculation should be
   performed across the entire transaction prepended by a synthesized IP
                    ^^^^^^^^^^^^^^^^^^^^^^
   header consisting of a 32 bit source IP address, a 32 bit destination
   address and a 16 bit UDP destination port encoded as 10 hex digits.
   When the interim AH mechanism is employed when TCP is the transport
   Layer, the UDP Port above becomes the TCP port, and all other
   operations are the same.
-- 
Regds,
Giri

-- 

S.G.Rajasekhar
             Member Technical Staff,
Networking Systems Lab,
HCL Technologies Ltd,
51, JN Road,
Ekkadu Thangal,
Guindy Industrial Estate,
Chennai -600 097.
Tel:2334174/2334181
Fax:2334256
Email: [email-masked]

---

From: Christian Groves <[email-masked]>
Date: Wed, 28 Mar 2001 14:28:23 +1000

G'Day all,

This sounds reasonable to me as Implementors' guide editor but I'm not a
security expert. Anybody have problems making this change?

Christian

---

From: "jkr" <[email-masked]>
Date: Wed, 28 Mar 2001 17:21:13 +0530

I think it was intended for the complete message, though wording was not
accurate as pointed out. ABNF sntax supports single authentication header
for the entire message (with multiple transactions).

Regards,

- JK
IPGEN

----- Original Message -----
From: "Christian Groves" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, March 28, 2001 9:58 AM
Subject: Re: Interim AH Scheme

G'Day all,

Christian

Giri Rajasekhar Saladi wrote:
>                                 .