[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: transport-friendly ESP



At 09:34 PM 1/27/99 -0500, Steve Bellovin wrote:
>I've set up a new mailing list, tf-esp@research.att.com, to discuss the
>design of a transport-friendly variant of ESP (a core piece of IPSEC).
>Subscription is via majordomo@research.att.com.
>
>The problem is that ESP, by hiding all of the TCP (and UDP) headers, makes
>life difficult for other purposes, such as discerning flows, building
>firewalls, etc.  Can we come up with a variant of ESP that -- optionally --
>leaves some of the packet header in the clear?
>

Interesting.  The end-to-end (e.g. host-to-host) nature of ESP conflicts
with the need for intermediate nodes to access header information.  Wouldn't
it make more sense to let ESP secure per hop IP links?  This way the transport
headers are automatically decrypted coming into a node and re-encrypted 
exiting it.  This allows firewall software, etc., to operate as-is.  If one
needs end-to-end security then TLS/SSL could then be layered on top.  I know
that that trusting intermediate nodes with clear IP packets in their RAM is 
a hard sell.  But if TLS/SSL is being used to protect end-to-end user data 
payloads, why not just use ESP to protect the management and use of individual
IP links?  I.e. the routing packets, nearest neighbor discovery, etc., along
with the datagrams (ICMP would need to handle its own end-to-end security).
This would eliminate the need for doing transport-friendly ESP variants.

- Alex

--

Alex Alten

Alten@Home.Com
Alten@TriStrata.Com

P.O. Box 11406
Pleasanton, CA  94588  USA
(925) 417-0159



Follow-Ups: References: