Subject: [Tsvwg] Ran's comment from Dublin meeting regarding RSVP groupkeying

From: Magnus Westerlund <[email-masked]>
Date: Wed, 15 Oct 2008 17:14:11 +0200

Hi,

Ran has kindly provided with some clarification on the comment he
provided at the microphone in Dublin for the WG and authors to consider:

It concerns the presentation:
http://www.ietf.org/proceedings/08jul/slides/tsvwg-2/tsvwg-2.htm

> Regarding Slides 4 and 5 of the presentation, AH protects
> the essential outer IP header fields and also outer
> security-critical IP options (for both IPv4 and for IPv6)
> and also protects whatever payload follows.
>
> Slide 4 is quite correct that no form of ESP is capable
> of protecting the outer IP header fields or IP-layer options.
> This is a critical, and not widely understood, difference
> between ESP-Null encryption and AH.
>
> So for the particular concern described in these slides,
> AH is an already standard, already deployable, well-known
> solution.   We at NRL demonstrated AH for protecting
> IPv4 and IPv6, including IPv6 ND traffic and IP options,
> to DARPA (Mike StJohns) in August 1995.  Multiple free
> implementations exist.
>
> So one could use AH with some group keying mechanism
> to address the issue on these 2 slides.  This could be
> done with or without the RSVP Integrity option and
> could be done with or without ESP encryption, as desired.

Best Regards

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Färögatan 6                | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------