Subject: IPSec and RSVP

From: [email-masked]
Date: Mon, 13 Sep 1999 09:00:40 -0400

Adding IPSec to the RSVP has required a few changes such as outlined in RFC2207,
but I am unclear about one issue.

When a PATH message is sent from a sender to receiver, the source IP address is
for the sender and the destination IP address if for the end-host receiver.  The
PATH message is received at each intermediate router and recognized as an RSVP
message from the IP protocol ID (46).  The PATH message is sent to the RSVP
process in that router and the state block is created and the PATH message is
changed to update the PHOP object.  I am unclear about this process when IPSec
is added to this scenario.  IPSec (in particular ESP), encrypts a IP Packet in
tunnel or transport mode and let's assume transport mode for this example.  The
SPI (Security Parameter Index) is computed for a message between the IP source
and destination address.  For the PATH message, the source and destination are
the end-hosts, and therefore the Security Association (SA) is between the
end-hosts.  My question is, how are the intermediate routers able to de-encrypt
the PATH message and perform the necessary functions in the RSVP process.  They
security key is only exchanged between the end-hosts and the intermediate
routers don't have this information to process the IPSec message.

My understanding is different for the RESV message because the IP source and
destination addresses are hop-by-hop (i.e. source=end-host; destination=first
RSVP capable router not the end-host sender).  In the case of the RESV message,
the SPI is computed for each individual hop and therefore each router can
properly de-encrypt the message.

Any help is appreciated.

Patrick Foy

---

From: Bob Lindell <[email-masked]>
Date: Mon, 13 Sep 1999 07:12:56 -0700

The RSVP protocol has support for message integrity.  It is not
based on IPSEC for some of the reasons you mention.  See the draft
http://www.ietf.org/internet-drafts/draft-ietf-rsvp-md5-08.txt which is
working it's way through IESG last call.

Bob Lindell