[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Q: Why IPSEC to be used only in CBC mode & not other like CFB or OFB ?
>>>>> "Chris" == Chris Trobridge <CTrobridge@baltimore.com> writes:
Chris> It does reinforce the advantages of authentication in ESP. I
Chris> don't know if I've come to the point of assuming ESP
Chris> authentication is pretty much essential through this group or
Chris> though discussions with customers, but what do others think?
I've been convinced by Steve Bellovin's papers that it is essential.
Unfortunately, we're not currently allowed to reject ESP with null
authenticaton. As far as I'm concerned, that's a bug, but
unfortunately some feel differently. We're definitely telling people
in documentation not to skip authentication.
Both in software and hardware, there is no performance justification
for omitting authentication.
paul
Follow-Ups:
References: