[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: notes from developer's portion of IETF meeting
Hilarie + Hugo,
As in my immediately preceeding message, I apologize for being
tardy in my response. I've thought about the idea of including a null
integrity transform in ESP, as you have both suggested, and I don't think
it's a good idea. Note that there seems to be general agreement that using
ESP w/o authentication is OK if one also applies AH to packets, so there is
already a precendent for situations where no authentication algorithm would
be selected. Thus, adding a null authentication algorithm would, I fear,
create the potential for confusion, since it already would be appropriate
thing to negotiate in some circumstances. Also, negotiation of a null
authentication algorithm seems equivalent to negotiation of NO
authentication algorithm, so I don't see the benefit from that perspective
either. Instead, I suggest that we leave this section of ESP as it is, and
note in the architecture document the security implications of not
including authentication in ESP when Ah also is not applied to packets.
That discussion will observe that some uses of AH with ESP avoid the need
for autentication in ESP but that use of ESP without AH is dangerous in
most other ciscumstances and thus such use should be negotiated only under
very carefully controlled circumstances.
Steve