[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Proposed changes to ESP (andf a little AH too)
> > The main argument against doing encryption first and auth second would
> > be - generally speaking there is no guarantee even if you verified the
> > CIPHERTEXT correctly, that the PLAINTEXT finally obtained is the same
> > as was sent.
>
> That's a robustness argument against authenticating the ciphertext,
> and a pretty good one if the decryption routine is complicated.
>
> However, if the decryption is simple & easy to analyze, we can (mostly)
> put to rest those fears about authenticating ciphertext.
It's also the case that the bulk of the protocols which will likely be
used inside ESP (IP, UDP, TCP) already use a simple 16-bit checksum,
which will cause most garbled traffic to be dropped.
If we assume that errors where the ciphertext is authenticated but the
decryption is garbled will most likely occur during debugging of new
code or manual keying, then that would seem to be an acceptable risk;
the operator(s) will interpret 99.998% packet loss as 100% packet loss
and start debugging..
We merely need to specify that the IP checksum MUST be supplied on
transmission and verified on receipt for packets nested inside ESP.
- Bill
References: