[IPsec] #122: Integrity proposals with combined algorithms

[Paul Hoffman <[e-mail]>]

The 4th paragraph of section 3.3 says "If an algorithm that combines encryption and integrity protection is proposed, it MUST be proposed as an encryption algorithm and an integrity protection algorithm MUST NOT be proposed." This means that an integrity protection algorithm can only be proposed with a Transform ID equal to NONE, given that a few paragraphs above, it says: "Combined-mode ciphers include both integrity and encryption in a single encryption algorithm, and are not allowed to be offered with a separate integrity algorithm other than "none"." We should thus make this clear in the 4th paragraph.

HOWEVER, in section 3.3.2, in the table for transform types, it says:
   Integrity Algorithm (INTEG)     3       IKE*, AH, optional in ESP
  (*) Negotiating an integrity algorithm is mandatory for the
  Encrypted payload format specified in this document. For example,
  [AEAD] specifies additional formats based on authenticated
  encryption, in which a separate integrity algorithm is not
  negotiated.
The second sentence seems wrong. Proposed rewording:
  For example,
  [AEAD] specifies additional formats based on authenticated
  encryption, in which the integrity algorithm is an inherent
  part of the combined algorithm; in this case, the
  integrity algorithm is specified as "none".

--Paul Hoffman, Director
--VPN Consortium