Re: [rohc] AD comments on draft-ietf-rohc-ipsec-extensions-hcoipsec-04

[Magnus Westerlund <[e-mail]>]

Ertekin, Emre [USA] skrev:
> Hi Magnus,
> 
> Please find our responses to your comments on the IPsec extensions
> draft.
> 
>> Section 3.1:
>>
>> Shouldn't it be discussed when this protocol number is appropriate to
>> be
>> used. To me it appears that some requirements need to be fulfilled
>> before one uses it on a particular layer. Running ROHC straight on top
>> of IPv6 for example seems like a bad idea in most case due to such
>> considerations as security and denial of service for the decompressor,
>> the multi-hop environment, and lack of clear logical channel.
> 
> This is good idea.  At the end of the section, we can add a paragraph
> that describes usage considerations of the ROHC protocol number.  
> 
> However, we would like to craft the paragraph such that it doesn't
> preclude the ROHC protocol number use in other scenarios.  Rather, the
> text will identify considerations that need to be accounted for if the
> ROHC protocol number is used for some other purpose.

Yes, fully agreed. I simply want some explicit mention on when this may
be considered suitable.


>> Section 3.2.1:
>>
>> What ICV algorithms and key lengths must be supported in the
>> implementations? This is to ensure that there are at least one
>> algorithm
>>  and key length that are supported by everyone.
> 
> This was discussed in a separate email thread.  I would recommend that
> we remain consistent the AUTH algorithm requirements defined in RFC
> 4835:  
> 
> 	 Requirement    Algorithm
>        -----------    ----------------
>        MUST           HMAC-SHA1-96 
>        SHOULD+        AES-XCBC-MAC-96 
>        MAY            HMAC-MD5-96 
> 
> Note, however, that this does not necessarily mean that HMAC-SHA1-96
> must be negotiated for any particular ROHC-enabled SA.  What is actually
> negotiated depends on depends on policy.  Specification of the above
> provides a "common denominator" for the AUTH algorithm that is available
> for use across all ROHCoIPsec implementations.
> 

Understood, it is all about enabling interoperability points. If policy
doesn't allow them, that is another question.

Cheers

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  [phone]
Färögatan 6                | Mobile [phone]
SE-164 80 Stockholm, Sweden| mailto: [e-mail]
----------------------------------------------------------------------