Re: [Ipsec] draft-ietf-ipsec-rfc2402bis-07.txt ... Suggest moving the "Flow Label" IPv6 base header field to "immutable" and protecting with AH

Francis,

I looked at RFC 3697.  It does state that AH does not protect flow 
labels, which is consistent with the old AH spec (RFC 2402). So, if 
we were to change this in the new AH spec, there would be a conflict. 
Also, the security analysis in 3697 argues that since there is no 
protection of the flow spec value, intermediate systems cannot rely 
on it and an end IPsec implementation cannot rely on it in transport 
mode.  I agree that it is unlikely that we would be able to manage 
key distribution for intermediate systems to be able to check the AH 
ICV, which supports your argument that it is not worth including it 
in the ICV computation.
However, if we choose to maintain backward compatibility with 2402, 
we need to clarify in 2402bis that this is the reason for not 
including the value in the ICV computation, as opposed to the 
current, erroneous rationale.

Is the WG comfortable with the status quo, i.e., NOT including the 
flow label in the ICV, despite the fact that it is immutable?

Steve

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec