[Tsvwg] Comments at IETF74 regarding draft-ietf-tsvwg-rsvp-security-groupkeying-04

["Michael Behringer (mbehring)" <[e-mail]>]

Bob, 

At the last IETF you made a comment at the microphone regarding 
http://tools.ietf.org/html/draft-ietf-tsvwg-rsvp-security-groupkeying

I wasn't there personally, but I believe your comment was along the
lines: "tunnel mode with address preservation is subject to change of
the outer address (like we pointed out for tunnel mode already), and
this should be mentioned explicitly." 

Do I capture your comment / suggestion correctly? 

If so, would the following change in section 6.6 address your comment,
or is it too simplistic? (suggested changes marked with ***)

--
6.6.  Applicability of Tunnel Mode with Address Preservation

   The document "Multicast Extensions to the Security Architecture for
   the Internet Protocol" [RFC5374] defines in section 3.1 a new tunnel
   mode: Tunnel mode with address preservation.  This mode copies the
   destination and optionally the source address from the inner header
   to the outer header.  Therefore the encapsulated packet will have the
   same destination address as the original packet, and be normally
   subject to the same routing decisions.  While [RFC5374] is focusing
   on multicast environments, tunnel mode with address preservation can
   be used also to protect unicast traffic in conjunction with group
   keying.

   Tunnel mode with address preservation, in conjunction with group
   keying, allows the use of IPsec AH or ESP for protection of RSVP even
   in cases where non-RSVP nodes have to be traversed.  This is because
   it allows routing of the IPsec protected packet through the non-RSVP
   nodes in the same way as if it was not IPsec protected.

***Note that IPsec tunnel mode with address preservation
   is also susceptible to the man-in-the-middle attack described in
section 
   6.2, since the outer header is not protected. This is a property of 
   IPsec tunnel mode; address-preservation does not change this
property.
--

Thanks for your help in reviewing this document! 
Michael