Re: [OPSEC] Prospective issue with IPsec ESP-NULL & IGP packets

["Vishwas Manral" <[e-mail]>]

Hi Ran,

>> The idea is that we are trying to move away from AH and ESP support to
>> only ESP support as most of the functionality of AH is sort of already
>> there in ESP, except for the points I mention.
>
> Hmm. AH provides more comprehensive protections than ESP,
> in a fundamental way.
Are you stating something other than what is in the link I provided.

>> Also note that AH is a MAY support for OSPFv3 while
>> ESP is a MUST (just like it is for IPsec).
>
> Most routers already ship with AH, so it is trivial to use AH.
Yes, but the aim is to move away from AH. AH has been downgraded to a
MAY support in IPsec RFC4301. It is the same for the OSPFv3 RFC too.

>> I think the final aim for us needs to be to support one protocol and
>> try to get all the functionality from the same. This is the reason we
>> are trying to make changes to ESP rather than using AH.
>
> At least some customers have a hard requirement for AH,
> rather than ESP.  It is possible that not all implementers
> care about those customers.
Ok.

>> This discussion however would be better part of the IPsec mailing list
>> then here in my view.
>
> You seem to have missed the main point of my note,
> which was an Operational Security matter, so I will restate:
Thanks for restating it. I am sorry if I missed the point.

>   There is no ESP attack vector that enables an interior
>   node to inject forged IGP packets into a different
>   target domain to subvert the target's IGP routing,
>   provided the user has configured their systems
>   appropriately (e.g. packet filtering at the edges),
>   modulo bugs in their deployed implementations.
Ran, the point we were talking is about the packet actually not being
able to be filtered by the edge node/ device because the packet is
encapsulated in the ESP header. Is there something amiss here - when
you say such a packet can be filtered?

>   In the case of implementation bugs, all bets are off
>   anyway, no matter how one configures one's systems
>   or designs one's network.
>
> The detailed analysis of why this is NOT actually a problem,
> even if ESP is in use, was provided in my previous note.
>
> Cheers,
>
> Ran
> [e-mail]
>
>
> _______________________________________________
> OPSEC mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/opsec
>
_______________________________________________
OPSEC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/opsec