Re: [secdir] Secdir review of draft-ietf-ospf-rfc6506bis-03

["Bhatia, Manav (Manav)" <[e-mail]>]

Hi Brian,

Thanks for the review. I have a comment inline.
> 
> But now RFC 5879 ("Heuristics for Detecting ESP-NULL Packets") has been
> published, which does describe some techniques to deterministically
> detect an unencrypted ESP packet. It may be still be difficult to
> prioritize certain OSPFv3 packets, but the justification is no longer
> precisely accurate. I would suggest something like the following
> rewording:

The justification still holds good as I don't think we will ever use heuristics for detecting ESP-NULL control packets that need to be consumed.

Its afaik primarily meant for firewalls that want to deep inspect packets. Obviously, there is nothing there in the standard that precludes it from being implemented on router's CPU path, but I doubt if we will ever go down that path. If this is really required on the routers, then WESP (RFC 5840) will probably be the path to go down on -- but that would require protocol extensions. 

Cheers, Manav

> 
>    Implementations desiring to prioritize certain OSPFv3 packet types,
>    e.g., Hello packets, over the other types, often perform the
>    prioritization prior to decryption. Parsing ESP packets is
> problematic
>    when the prioritization code does not know whether the ESP packets
>    include an encryption algorithm, or are instead ESP-NULL packets
> [RFC2410].
>    Techniques exist to identify ESP packets using ESP-NULL packets
>    [RFC5879], which would allow these packets to be examined  and
>    prioritized. However, the techniques may not be practically applied
>    within the prioritization code.
> 
> Brian