IETF Logo Mail Archive

Re: Failure of AH

Brian E Carpenter <brian.e.carpenter@gmail.com> Mon, 20 March 2017 22:44 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E693712940D for <ipv6@ietfa.amsl.com>; Mon, 20 Mar 2017 15:44:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y2UWn8DsxcBQ for <ipv6@ietfa.amsl.com>; Mon, 20 Mar 2017 15:44:54 -0700 (PDT)
Received: from mail-io0-x22b.google.com (mail-io0-x22b.google.com [IPv6:2607:f8b0:4001:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50CDD129406 for <ipv6@ietf.org>; Mon, 20 Mar 2017 15:44:54 -0700 (PDT)
Received: by mail-io0-x22b.google.com with SMTP id l7so38888876ioe.3 for <ipv6@ietf.org>; Mon, 20 Mar 2017 15:44:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=/pm6dBhh2yCUEQpn7iHuKJ8jECli6PI1CN96SJgS6jQ=; b=M3P8dSsNsjNdTIoPgg5lEcGN/8ejRK9/Q/NgN0Ck0+D//3KObuQUEryf4wWLkzr0F/ 5Sil1PSuSqjFrokIinWIYgKJKUWah5xYzUopw3UaDdlasO6K3cpEfeokGmP0FU2P149t XPyq8/ovVipWW0ZCJ1s8sNyipL4nmFa2FlDAmuO7F/bfGHE77cT4hkIY7pqIR8a73zXB bjNPd0pqSthtdCl5YoSDxw3SbQPw+yXM3sjUOHaZRmEFF6vohoi1e3rwQ1M8ptXZb06E JCYy/tjonFJ43suW7NjSy9o6n6GPsM/J5YozWOtb4Lvy4I4r1WBHoq+/P6Iml0Ugxn5a +49w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-transfer-encoding; bh=/pm6dBhh2yCUEQpn7iHuKJ8jECli6PI1CN96SJgS6jQ=; b=uB8t/CD8nYRIsaGNagpbn4OjkJIAnASQquY4O7dF2UPrHQ8NWPhDWBYmQ0yFKr8HQv XYrzUMjKdOAGFG1CqUqimHQE7RN8UfnO5fhM6Z2qASM92eqtPVO/eDkSIlX4iVSPNhH1 l0opJY2ztyB55Nx1HqVGFgFaEVa15Jjd+7wBaR7Nar9WWG2K74VwSnUj9LQHXurt/C4I v3dMPHLg0OniepkJN/ITWp7rnNbB7kDSMTvD+dtApqB5Oiyxijuq0Q2t+X1zqAzDp2d5 5aCnbnyBL3DrDrvVvmuBQgjDZRSGIMQ0Dqs5HQdSlkYpiB02WSs4krcoEbyGCZ0rheHf uIfA==
X-Gm-Message-State: AFeK/H3TPqiG2pNF9Ulol6O/HlqsMRYp9HmLYGZ/pMkhnCtYvgltzi0aE2sbDVCrUmWipg==
X-Received: by 10.107.153.9 with SMTP id b9mr28837053ioe.200.1490049893535; Mon, 20 Mar 2017 15:44:53 -0700 (PDT)
Received: from [172.16.11.95] (50-76-68-137-static.hfc.comcastbusiness.net. [50.76.68.137]) by smtp.gmail.com with ESMTPSA id b88sm5858800itd.21.2017.03.20.15.44.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 20 Mar 2017 15:44:53 -0700 (PDT)
Subject: Re: Failure of AH
To: Michael Richardson <mcr+ietf@sandelman.ca>, Christian Huitema <huitema@huitema.net>
References: <599257D7-532D-4512-929B-D124623EAF35@ericsson.com> <37ED3E78-B23A-4D29-8597-5A63236129B1@cisco.com> <887bd0f0-32a5-56f1-9ac9-703ecb97a760@gmail.com> <80D8FFF0-2674-48A7-A935-11681F5C5A4D@jisc.ac.uk> <A67E1C07-282B-4422-A2FF-86F6CACBD775@cable.comcast.com> <ab7c95a5-9776-24b5-7c26-4c5987d4c948@isi.edu> <ed2f5144-52fb-dda5-1fb4-62be1625b341@gmail.com> <401F52B1-3D41-4174-9425-50571B2D0B9E@jisc.ac.uk> <6d51de4b-3a9d-0f34-1cd2-5bb30caed75e@gmail.com> <DE16D91D-AE7B-4D3C-B8EA-0CB644FB96BD@cable.comcast.com> <CA+b+ER=6dXLiwvLJa84uvpVeH0daGnZ-06P16JD0UutTrbUYyA@mail.gmail.com> <2a808465-58c9-1d5e-700b-f04043b33c1c@gmail.com> <32305.1489937663@obiwan.sandelman.ca> <0e628656-f8b2-effb-9f93-2efe6b0ee4c5@gmail.com> <11502.1489948766@obiwan.sandelman.ca> <735862da-0e36-b36d-5f0f-0c25245c0f2a@huitema.net> <18061.1490019476@obiwan.sandelman.ca>
Cc: 6man WG <ipv6@ietf.org>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
Message-ID: <a9e919b4-df76-f8d1-a7a9-3a632fc03b23@gmail.com>
Date: Tue, 21 Mar 2017 11:44:55 +1300
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <18061.1490019476@obiwan.sandelman.ca>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/JPARJOy-2Ixxmvp_UR7-n--Jgjs>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Mar 2017 22:44:56 -0000

On 21/03/2017 03:17, Michael Richardson wrote:
...
> So I'm just not worried about breaking AH.

That's well understood for today's AH. What bothers me is that
if we allowed en-route changes to headers now, without thinking this
aspect through, we might make any future AH-like authentication
mechanism impossible too. So at a minimum, we'd have to be sure
that inserted, modifiable and deletable headers are marked in some
way that will allow them to be excluded from authentication. That
was thought about years ago for IPv6 options, but not for extension
headers.

    Brian

v2.14.0 | Report a Bug | By Email