[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bellovin's and Ashar's attacks
On Apr 12, 15:43, Dan Nessett wrote:
% Since encryption is taking place at the IP layer, there can be no
% expectation that rekeying will not occur on each packet. IP packets
% can be coming from all over the place and will produce a jumble. Any
% ESP implementation will have to deal with frequent rekeying, although
% some operational environments may not require it, e.g., where a
% machine is encrypting traffic to only one other machine.
Hmm. Actually, ESP is _both_ an IP encryptor and also a
transport-layer encryptor, depending on how a particular session is
setup. It is important for everyone to keep this in mind. The
working group name is somewhat misleading by accident because folks
think it is restricted to the IP-layer. No such restriction exists
in either AH or ESP.
As an aside, one of the things I've not been good about making clear
in my notes is that my interest in user-oriented keying has much to do
with the use of ESP as a transport-layer encryptor.
Now back to editing...
Ran
atkinson@itd.nrl.navy.mil
References: