Re: [IPsec] Working Group Last Call: draft-ietf-ipsecme-esp-ah-reqts

[RJ Atkinson <[e-mail]>]

> Perhaps some text along the line of:
> 
> 	ESP-NULL offers the same protection as AH, ...

  This sentence above is not true.  ESP-NULL and AH provide 
different security properties to the IP-layer.

  AH protects all IP options, whereas ESP cannot protect any 
IP options that appear prior to the ESP header -- the location
in the packet where those IP options are seen *and acted upon* 
by routers/firewalls/etc.

  Similarly, AH protects many IP header fields from in-transit
modification, whereas ESP encapsulation provides no protection
for the 1st (outer) IP header (i.e., that appears before the ESP header).

  As a prior discussion has noted, AH can and is used to provide
cryptographic protection to some security-critical IP options
(e.g. sensitivity labels).  ESP-NULL is not capable of protecting
those options.  

  The reason AH is MAY is that not all deployments care about
protecting the (outer) IP header and (visible to the forwarding
plane) IP options.  Some deployments definitely do care.  Other
deployments do not.

Yours,

Ran