Re: [IPsec] Avoiding Authentication Header (AH)

["Bhatia, Manav (Manav)" <[e-mail]>]

Ran,


> You might also be interested in the following draft which will be published as RFC any time now:
> http://tools.ietf.org/html/draft-ietf-ospf-auth-trailer-ospfv3-11

> I am well aware of it.  That document does NOT deprecate use of AH with OSPFv3 either.

It doesn't need to because nobody uses it.

The reason the above draft exists is because there were many people (at least service providers) who said that they did NOT want to use IPsec for OSPFv3. I am sure you have customers who love using IPsec for OSPFv3, but there is a larger percentage that doesn't.

>>> This WG ought not make existing legitimate uses of AH invalid or not recommended.  
> 
>> What makes you think that this draft is trying to do that?

> The text in your two drafts on the topic.

You did not understand the drafts.

Please point to specific text that you think "make existing legitimate uses of AH invalid or not recommended."

The draft only talks about future applications and protocols.

[clipped]

> For IPv6, there are multiple reasons, including but not limited to:
>	- There still is no 100% reliable way to parse past an
>	  ESP NULL header 

Would appreciate if you can explain why you think WESP cannot reliably parse past an ESP header?

>	-- IPv6 has strict rules on the order of headers
>	   and an ESP NULL header can't appear before either 
>	   a Routing Header or a Hop-by-Hop Options Header 
>	   because those two header types need to be 100% readable 
>	   by routers handling the IPv6 packet.

Routing Header is a security nightmare.

You were probably not aware that it has been recently deprecated by the IETF.

http://tools.ietf.org/html/rfc5095

>From the draft-bhatia-ipsecme-avoiding-ah-00:

   Hop-by-Hop options are not an issue, as the intermediate
   hops do not have keys to verify the message authentication code so
   they cannot really be protected anyways.

If you think not having ESP header before a few headers is a concern then we should fix that. If fixing this thing can get us rid of one protocol then its probably a good thing to do.

Cheers, Manav