Re: About AH (was Re: [Errata Held for Document Update] RFC8200 (5933))

On Tue, 3 Mar 2020, 20:09 Eric Vyncke (evyncke), <evyncke=
40cisco.com@dmarc.ietf.org> wrote:

> Without any hat except the hat of an individual contributor having spent
> many years in IPsec and in IPv6 within the IETF and with real life
> deployments.
>
> As there are some discussions  about 'breaking AH' [1], here are some
> further points:
> - some IETF RFC also exclude AH in transport mode: e.g., all NAT64
> (including MAP-* as they do NAT44)
> - IPsec RFC 4301 specifies a MAY for AH and a MUST for ESP, see section
> 3.2 "IPsec implementations MUST support ESP and MAY support AH. "
> - RFC 8504 (IPv6 nodes requirements) make the support of IPsec as a SHOULD
> in section 13.1
>
> IMHO, any specification breaking AH (e.g., by modifying the NextHeader in
> transport mode) should clearly note that it 'breaks AH' or constraints its
> use; but, this is still acceptable for an IETF standard specification IMHO
> to 'break AH'.
>

So if a spec says AH doesn't apply, then all IPv6 fields are mutable within
that spec? Could that spec be on the IETF standard track? It seems so,
since SRNP with PSP is.

It seems that Network Prefix Translation could be changed from Experimental
to Standards Track just by adding an "AH doesn't apply" statement.

Errata updates to RFC 8200 may as well remove any and all processing
prohibitions rather than further clarify them, because it sounds like "AH
doesn't apply" is the loophole to avoid all of them while still claiming to
be "using" RFC 8200 IPv6.

> Finally, I have spent 10+ years designing and deploying IPsec VPNs and
> very few of them were using AH and when using AH it was in tunnel mode
> (except OSPFv3) and until ESP was extended to have authentication.
>

I seem to remember that 20 years ago when I did quite a bit of IPsec work,
Cisco worked around not having true IPsec virtual tunnel interfaces by
using GRE tunnels and then protecting them using IPSec in transport mode
with both AH and ESP; AH being necessary to protect the outer tunnel IP
header, and ESP protecting the GRE header and the GRE payload.

Deprecating AH is probably the equivalent of deprecating IPsec transport
mode.

Regards,
Mark.

> Hope this helps to clarify the discussion about any document
>
> -éric
>
> [1] please note the quotes around 'break AH' as it is rather 'prevent the
> use of AH in transport mode' in most current discussions.
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>