[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IPSEC & ROAD
I think IP version issues are probably orthogonal to the IP security
design I had in mind.
An "IP security protocol" should be just that - a modular "protocol"
that rides above IP. The Protocol field in the IP header would contain
a (newly assigned) value meaning "security protocol". The original
Protocol value (e.g., corresponding to TCP or UDP) would move into a
field inside the (encrypted) security protocol header. On the wire,
the packet might look something like this
Link header, type = IP|IP header, PID=security|security header, PID=6|TCP|data
|<- clear ->|<- encrypted ->|
This makes the security protocol a modular component that could ride
on top of any IP-like protocol, regardless of address size or format,
and under any transport protocol. And when practicality (i.e., lack
of universal implementation) dictates that you use the IP security
protocol in a "security gateway" instead of in the hosts being
protected, you use a separate mechanism (e.g., protocol 94, IP-IP) to
carry the "inner" IP datagram on top of the security protocol:
Link |"outer" IP hdr|security hdr, PID=94 | "inner" IP hdr, PID=6 | TCP|data
|<- clear ->|<- encrypted ->|
If the security protocol follows this general design, then it ought to
be independent of IP version, so long as protocol fields remain 8 bits
wide. And as long as IP remains connectionless (if it doesn't, I quit!
:-).
Phil