[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Isis-wg] Re: Deprecation of AH header from the IPSEC tool kit
At 14:07 14/06/00 , Ben McCann wrote:
>Aren't your goals met by using ESP _tunnel_ mode?
No. ESP does not and can not authenticate the IP headers
and IP-layer options. If the options are in a tunneled
packet, the outer header's options (i.e. the ones actually used)
are still unprotected.
AH and ESP do not have the same security properties. The
things that most folks dislike about AH would be similarly
annoying if there were an ESP variant that protected the
outer header.
Ran
rja@inet.org
Follow-Ups:
References: