Re: [IPsec] Avoiding Authentication Header (AH)

[Sean Turner <[e-mail]>]

Manav,

I'm trying to figure out whose implementation this situation will create 
a problem for?  If the new application or protocol ends up doing one of 
the 3 things you listed 
(http://www.ietf.org/mail-archive/web/ipsec/current/msg07401.html), then 
is the problem that those who haven't implemented AH now have to?

Are there any new applications or protocols that are mandating the use 
of AH?

Currently, I'm unconcerned about somebody sneaking a new protocol that 
mandates AH past the IETF because of this group.  This group certainly 
isn't made up of shrinking violets ;)

spt

On 1/4/12 9:22 AM, Bhatia, Manav (Manav) wrote:
> Hi Marc,
>
> We don't say that. 4301 says that implementations MAY support AH and MUST support ESP.
>
> This creates a problem for implementations if in future a new application or a protocol mandates the use of AH.
>
> I will even go a step further and say that newer protocols should just assume ESP-NULL and not even bother with AH if they can do with just ESP.
>
> Cheers, Manav
>
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]]
> Sent: Wednesday, January 04, 2012 7:46 PM
> To: Bhatia, Manav (Manav)
> Cc: Nico Williams; [e-mail]
> Subject: Re: [IPsec] Avoiding Authentication Header (AH)
>
>
>>>>>> "Manav" == Manav Bhatia<Bhatia>  writes:
>      Manav>  Hi Nico,
>
>      >>  Advising (and updating said advice as circumstances change)
>      >>  use-IPsec protocol designers as to when to use ESP and/or AH is
>      >>  something we should do.  Deprecating AH seems like a nice idea,
>      >>  but if there's good reasons to still use it, then maybe not.
>
>      Manav>  We're not talking about deprecating or killing AH. I concede
>      Manav>  that I did allude to it in my first draft, but then changed
>      Manav>  the tone based on the WG feedback, to say that we should
>      Manav>  "avoid" AH wherever possible.
>
> This is the status quo already.
> Why do we need this draft?
>