Re: [mpls] FW: New Version Notification for draft-farrelll-mpls-opportunistic-encrypt-04.txt

[Uma Chunduri <[e-mail]>]

Hi Stephen,

In-line [Uma]:

--
Uma C.


-----Original Message-----
From: Stephen Farrell [mailto:[e-mail]]
Sent: Thursday, January 29, 2015 3:33 AM
To: Uma Chunduri; [e-mail]; [e-mail]
Subject: Re: [mpls] FW: New Version Notification for draft-farrelll-mpls-opportunistic-encrypt-04.txt



On 29/01/15 04:03, Uma Chunduri wrote:
>  But the important point here is - packet is getting encrypted and decrypted
>                multiple times;

Sorry, but that is not the case. The packet is encrypted once and decrypted once when following this specification. And the packet can traverse LSRs whilst encrypted without those having to decrypt and then re-encrypt.

[Uma]: I am sure then there is some gap (in my understanding perhaps??), but from the draft I clearly see this-

From Section 3:

                    ----------- .      -----------
                   | Top Label | .    | Label 15  |
                   +-----------+  .   +-----------+
                   |   Label   |   .  | MEL   S=1 |
                   +-----------+    . +-----------+
                   | Label S=1 |     .| Ctrl Word |
                   +-----------+      +-----------+
                   |           |      |           |
                   ~  Payload  ~      ~ Encrypted ~
                   |           |      |           |
                    -----------........-----------

        Figure 1 : The Use of the MEL for Hop-by-Hop Encryption


Each LSR has to decrypt first to get the top label and at the egress swap it without label encrypt with keys for the neighbor, put MEL and send out, right? And the same should happen at each LSR..isn’t it??



The entire e2e path of a packet may cause it to traverse more than one encrypt/decrypt but that is as true for IPsec as it is for this. That is, one can arrange that the endpoints of cryptographic protection are wherever you want.

S.