[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Transport / Tunnel Mode
Of course the routing and fragmentation issues are important. I was merely
pointing out an additional security flaw with transport mode ESP.
If the transport mode SA is host-sgw or sgw-sgw such that the SA may cover a
range of IPs, AH must be used in order to protect the IPs. Otherwise, an
intermediate router can redirect the traffic to a different host behind the
gateway, which could aid a combined internal-external attack.
Andrew
--------------------------------------
Beauty with out truth is insubstantial.
Truth without beauty is unbearable.
> -----Original Message-----
> From: Henry Spencer [mailto:henry@spsystems.net]
> Sent: Wednesday, November 29, 2000 6:29 PM
> To: Andrew Krywaniuk
> Cc: 'IpsecMailingList (E-mail)'
> Subject: RE: Transport / Tunnel Mode
>
>
> On Wed, 29 Nov 2000, Andrew Krywaniuk wrote:
> > And isn't there also the issue that you couldn't use ESP
> authentication with
> > sgw-sgw or host-sgw transport mode? AH would again become
> mandatory in order
> > to protect the outer (and only) header.
>
> Not (absolutely) necessarily. In IPv4 in particular, AH protects very
> little that's of interest except the source and destination
> addresses.
> Remember that authentication tells you not only that the
> packet has not
> been altered in transit, but also that it did actually come
> from the other
> end of that SA. Depending on which packets are flowing
> through which SAs,
> the mere fact that a packet emerged from a particular SA (and
> passed its
> authentication) might be enough to verify source and
> destination addresses.
>
> As others have noted, and as RFC 2401 explicitly states in
> 4.1, the bottom
> line is that multiple fragments may not follow the same route to reach
> their destination. So when decryption (etc.) is being done by an
> interposed security gateway rather than by the end host, the security
> gateway must be the ostensible destination of the packet, so it can be
> sure it gets all the fragments.
>
>
> Henry Spencer
>
> henry@spsystems.net
>
>
>
References: