Re: [IPsec] WESP - Roadmap Ahead

"Bhatia, Manav (Manav)" <> Thu, 12 November 2009 02:01 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id DE77E3A692A for <>; Wed, 11 Nov 2009 18:01:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.287
X-Spam-Status: No, score=-2.287 tagged_above=-999 required=5 tests=[AWL=0.312, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ytuHrTZpJkVI for <>; Wed, 11 Nov 2009 18:01:57 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id CF35C3A69C5 for <>; Wed, 11 Nov 2009 18:01:57 -0800 (PST)
Received: from ( []) by (8.13.8/IER-o) with ESMTP id nAC22PIw014680; Wed, 11 Nov 2009 20:02:25 -0600 (CST)
Received: from ( []) by (8.13.8/emsr) with ESMTP id nAC22NxC011072; Wed, 11 Nov 2009 20:02:24 -0600 (CST)
Received: from ( []) by (8.13.7/8.13.7/Alcanet1.0) with ESMTP id nAC20tGm018653; Thu, 12 Nov 2009 10:00:57 +0800
Received: from ([]) by ([]) with mapi; Thu, 12 Nov 2009 07:32:21 +0530
From: "Bhatia, Manav (Manav)" <>
To: Scott C Moonen <>, Jack Kohn <>
Date: Thu, 12 Nov 2009 07:32:18 +0530
Thread-Topic: [IPsec] WESP - Roadmap Ahead
Thread-Index: AcpjEvdzf17YD+2NT+KtXbSkpJVbQgAID50w
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.57 on
X-Scanned-By: MIMEDefang 2.64 on
Cc: "" <>
Subject: Re: [IPsec] WESP - Roadmap Ahead
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discussion of IPsec protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 12 Nov 2009 02:01:59 -0000


> From: On Behalf Of Scott C Moonen
> Sent: Thursday, November 12, 2009 2.37 AM
> To: Jack Kohn
> Cc:;
> Subject: Re: [IPsec] WESP - Roadmap Ahead
> Jack, I'm not sure it's clear yet whether WESP will be widely adopted.  
> There's disagreement between end-node and middle-node folks as to whether 
> WESP or heuristics are the best approach for inspection of ESP-NULL traffic.  
> I think that end-node vendors will be very reluctant to adopt 

I cant comment on the interest of the end-node vendors, but i can certainly say that this will be of interest to the router vendors. There are currently a lot of applications (routing/signaling for instance) where we use ESP-NULL for integrity protection (confidentiality is not an issue there) and it will be really good if there are ways to deep inspect these packets for proper QoS treatment.

> WESP widely until there is broad customer demand for it, and I'm not 
> sure that this demand will ever materialize. 
> This is all my personal opinion, of course.  But it seems to me that heuristics 
> will have to be adopted by competitive middle-node vendors, and 
> therefore (barring any extensions to WESP that make it attractive 
> for other reasons) the use of heuristics will probably always be more 
> widespread and will dampen the demand for WESP.  Additionally, 

There you go:

> ESP-NULL itself has rather narrow applicability in an environment where 
> end-to-end encryption is increasingly common, which further limits 

Most routing, signaling protocols use ESP-NULL (it's a MUST, while support for AH is a MAY) and I can see benefits of moving to WESP from the QoS perspective. I am not saying that we cannot do QoS with ESP, but it just becomes a tad more flexible/easier with WESP.

> the cases where there will be an absolute need for WESP.  Furthermore, 
> there will always be valid reasons to use AH (reduced overhead compared to WESP). 
> For reasons like these, I believe it's premature to call for deprecation 
> of AH and even more premature to start preferring WESP to ESP. 

I agree.

> What status will the WESP RFC have?  Experimental, informational, standards track, etc.? 

Standards Track

Cheers, Manav

> Scott Moonen (
> z/OS Communications Server TCP/IP Development
> <>