Re: [tsvwg] draft-ietf-udp-options issues from IETF 104

[Joe Touch <[e-mail]>]

> On Jul 12, 2019, at 7:09 AM, Black, David <[e-mail]> wrote:
> 
> My rationale for OCS not making a lot of sense with LITE is that use of LITE is a clear indication from the sending application that correctness of the LITE data on receipt is optional.  Beyond that, I believe you’ve pointed out that zeroing the UDP checksum is a related scenario where correctness of all of the UDP data may be optional – that scenario is more subtle, because one of the rationales for zeroing the UDP checksum is presence of another integrity mechanism elsewhere in the protocol stack that covers the data (although protocol designers need to watch out for uncovered IPv6 headers – see RFC 6935 and RFC 6936). 

Agreed, but keep in mind that NAT boxes that modify IP addresses and transport ports - and other fields - simply recalculate checksums to cover their tracks. So there’s little point to worrying about whether they’re ‘covered’ by transport protections.

Users who really care about this sort of behavior really need to use some sort of encryption or authentication over the whole packet. Mere checksums aren’t enough.

Joe