Re: [IPsec] Avoiding Authentication Header (AH)

[Tero Kivinen <[e-mail]>]

Bhatia, Manav (Manav) writes:
> Hi Sean,
> 
> All I am saying is this:
> 
> There are many implementations that don't support AH as 4301 has a
> MAY support clause for AH.

Just noting that same is true for WESP. It is not mandatory to
implement, and I would claim there are way more implementations out
there supporting AH than there are supporting WESP. 

> Even within IETF there could be WGs looking at using or extending
> AH.

If there are some, just point us to them... anyways extending AH would
clearly require comments from the IPsec community so doing such thing
and not getting comments from this list would (or at least should) be
impossible.

> Given that ESP does everything useful that AH does, it makes no
> sense to continue using AH. I think we should have a draft that says
> this. However, there are some very corner cases where it *may* make
> sense to use AH (though I am still a little unconvinced, but I'll
> concede for the sake of moving on) and people are most welcome to do
> that.

ESP-NULL does not provide the "reliable 100% proof" ability to parse
past the header. WESP does, but that is in the same category in the
implementations than AH (MAY), so that does not help.

Heuristics does provide a way to parse past the headers, but people
claim it is not reliable enough for them, and again it is in same
category in the implementations. Altough deploying heuristics
implementation is faster as it only requires changes to middleboxes
not end nodes...

> If a WG ends up mandating AH (when ESP could have been used) then
> Yes it's a problem for everyone, right from the vendors to the
> users, who have to now support AH too in their products and
> networks.

If WG wants to mandate AH, and we cannot convince them otherwise,
having a document which says so does not help. On the other hand if we
have stealth WG trying to sneak AH past IPsec community, I think they
will also conviently ignore this document too.

In summary I do not think there is problem, and I do not think we need
to say anything about AH right now.
-- 
[e-mail]