[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Death to AH (was Re: SA identification)
> so i guess "death to AH" and "ipsec is for VPN only" are
> related.
As others have pointed out, this relationship is weak at best.
In particular, any IPsec implementation should include policy checks
after ESP decapsulation which not only verify that the IP headers
haven't been tampered during transit, but also that they were correct
to begin with..
> it is correct that there are certain extension headers that does not
> need protection, however, there are certain application that needs
> AH (especially with transport mode). as increasing number of protocol
> documents are relying upon the existence of ESP and AH (like most of
> IPv6 routing protocols)
Could you give pointers? (i don't follow the routing area closely).
> i believe we need AH definitely.
I think we need a "this is how to use ipsec to protect your
protocol"/"this is what ipsec provides to upper-layer protocols"
document...
- Bill
Follow-Ups:
References: