Re: [IPsec] WESP - Roadmap Ahead

[Stephen Kent <[e-mail]>]

Jack,

Thanks for describing the additional selection criteria that must be 
employed to avoid the problem I cited.

Given this more complete description of the selection criteria, I am 
not convinced that that is a significant benefit for using WESP in 
this context.

	- Whether using WESP or just ESP-NULL, the router needs to 
determine that the packet is addressed to it.  This means looking for 
either a unicast address (per interface?) or a multicast address. I 
thought that the traffic of interest would arrive on a multicast 
address. If so, then this is a very easy check.

	- Traffic other than OSPF can be addressed to the router, but 
I'm not sure what other traffic would be multicast. For unicast 
traffic addressed to the router, if some of that is protected using 
ESP with confidentiality, then the address check might have to be 
extended to include a source address as well.

	- There is an assumption that the OPSFv3 traffic is 
(ultimately)  protected using ESP-NULL. The next check that you 
described, i.e., looking for a few bits that indicate whether the 
payload is OSPF and appears to be a HELLO or ACK, is the real focus 
of this thread.  There appears to be a couple of cases:

	- If all multicast traffic directed to the router and 
protected using ESP is ESP-NULL, then WESP seems to help ONLY if 
there are algorithms being used for different SAs, AND if those 
algorithms result in different offsets for the start of the ESP-NULL 
payload. It's not clear that this is a realistic case. But, in this 
case, using WESP could avoid the need to check the SPI in the packet. 
What's not clear is whether checking for WESP and extracting the 
offset info is faster than matching against a set of SPIs.

	- if some multicast traffic directed to the router is 
protected with ESP with confidentiality, in addition to the ESP-NULL 
OSPF traffic, then one would need to check SPI values to 
differentiate between these two classes of traffic.

So, the question of whether we have one multicast SA for this 
traffic, or potentially a lot of these SAs is potentially relevant. 
As I mentioned in my previous message, this is not completely clear 
to me from 4552. You didn't respond to that part of my message, so I 
don't know if that means you find the RFC unclear on this point as 
well, or if you didn't think it mattered to this discussion. Well, if 
appears to matter, if one believes that the number is substantial.

So, the bottom line appears to be that WESP might be better than just 
using ESP-NULL, depending on the number of multicast SAs that 
terminate at the router, that make use of ESP, and maybe whether the 
ones that use ESP make use of different integrity algorithms that 
result in different offsets.  That is a lot of IFs for which we have 
yet to get an answer.

In any case, as I noted earlier, because of the use of manual keying 
in this context, selecting a subset of packets for out-of-order 
processing does not impose any burden on the IPsec for the remaining 
packets, so all of the comments about that issue were red herrings.

Steve