Re: [IPsec] Avoiding Authentication Header (AH)

Hi Sean,

first, thanks for the collective compliment. But in fact I have seen two 
recent cases where IPsec/IKE-related work did manage to sneak past this 
workgroup until quite late in the process ( 
http://tools.ietf.org/html/draft-ietf-hokey-rfc5296bis-06, 
http://tools.ietf.org/html/draft-ietf-dime-ikev2-psk-diameter-11). It 
may be a matter of lack of communication or lack of energy, but these 
things do happen. So I do see value in a draft that explicitly 
recommends not using AH in general, and points out where AH does make sense.

Thanks,
Yaron

On 01/05/2012 05:31 AM, Sean Turner wrote:
> Manav,
>
> I'm trying to figure out whose implementation this situation will 
> create a problem for? If the new application or protocol ends up doing 
> one of the 3 things you listed 
> (http://www.ietf.org/mail-archive/web/ipsec/current/msg07401.html), 
> then is the problem that those who haven't implemented AH now have to?
>
> Are there any new applications or protocols that are mandating the use 
> of AH?
>
> Currently, I'm unconcerned about somebody sneaking a new protocol that 
> mandates AH past the IETF because of this group. This group certainly 
> isn't made up of shrinking violets ;)
>
> spt
>
> On 1/4/12 9:22 AM, Bhatia, Manav (Manav) wrote:
>> Hi Marc,
>>
>> We don't say that. 4301 says that implementations MAY support AH and 
>> MUST support ESP.
>>
>> This creates a problem for implementations if in future a new 
>> application or a protocol mandates the use of AH.
>>
>> I will even go a step further and say that newer protocols should 
>> just assume ESP-NULL and not even bother with AH if they can do with 
>> just ESP.
>>
>> Cheers, Manav
>>
>> -----Original Message-----
>> From: mcr@sandelman.ca [mailto:mcr@sandelman.ca]
>> Sent: Wednesday, January 04, 2012 7:46 PM
>> To: Bhatia, Manav (Manav)
>> Cc: Nico Williams; ipsec@ietf.org
>> Subject: Re: [IPsec] Avoiding Authentication Header (AH)
>>
>>
>>>>>>> "Manav" == Manav Bhatia<Bhatia> writes:
>> Manav> Hi Nico,
>>
>> >> Advising (and updating said advice as circumstances change)
>> >> use-IPsec protocol designers as to when to use ESP and/or AH is
>> >> something we should do. Deprecating AH seems like a nice idea,
>> >> but if there's good reasons to still use it, then maybe not.
>>
>> Manav> We're not talking about deprecating or killing AH. I concede
>> Manav> that I did allude to it in my first draft, but then changed
>> Manav> the tone based on the WG feedback, to say that we should
>> Manav> "avoid" AH wherever possible.
>>
>> This is the status quo already.
>> Why do we need this draft?
>>
> _______________________________________________
> IPsec mailing list
> IPsec@ietf.org
> https://www.ietf.org/mailman/listinfo/ipsec