[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: IPSEC WORKING GROUP LAST CALL
Baiju,
>My comments:
>
>If I read above statements carefully, it seems that Steve Bellovin is
>saying that authentication is
>mandatory for ESP which is different from what Steve Kent says.
In this case, Steve kent is right. I read Steve Bellovin's remarks to be
emphasizing the importance of authentication in conjunction with
encryption, and that it would be dangerous to employ one without the other.
The ESP intro says excatly that, but because one could choose to achieve
authentication by various combinations of the IPsec protocols, it is not
mandated that ESP always enable authentication.
>I have been reading documents to figure out how you
>can specify not to use authentication with ESP
In the ESP spec, the introduction clearly states that authentication is an
optional feature, while confidentiality is mandatory. Section 2.7 goes on
to state that the ICV is an optional field that is present only if
authentication is selected for the SA. So, the issues seems to be whether
the DOI provides the requisite "transform identifiers" for negotiating this
combination of services. If not, then we have another mismatch between the
documents, but it shouild be easy to fix.
Steve