[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Death to AH (was Re: SA identification)
At 09:42 AM 4/13/01 , Steven M. Bellovin wrote:
>In message <200104131628.ABY04112@mira-sjcm-3.cisco.com>, Scott Fluhrer writes:
>>At 07:52 AM 4/13/01 , Steven M. Bellovin wrote:
>>>In message <sjmy9t4khhm.fsf@rcn.ihtfp.org>, Derek Atkins writes:
>>>>So does ESP with Authentication and NULL-encryption.
>>>
>>>Yes, but it's not context-free -- unless you know a priori that null
>>>encryption is being used, you can't monitor it.
>>>
>>>This is the one point I'll concede to the AH proponents...
>>
>>Actually, I wouldn't concede quite so quickly. AH is not context-free
>>either -- unless you know a priori that the packet AH is protecting is
>>not itself encrypted (e.g. ESP is not being used along with AH), you
>>can't monitor it either.
>
>There's a Next Protocol field in the AH header that you can look at.
If all you're interested in is telling if the encapsulated packet is
encrypted or not, there are ways to tell with ESP (with possibly
null encryption) as well. In tunnel mode, you can check if the bits
where the encapsulated IP header would be makes sense as an
unencrypted IP header (IP version number is 4 or 6, checksum is
valid). In transport mode, you can (usually) check the transport
header. Granted, with AH, it's somewhat easier...
>
>
> --Steve Bellovin, http://www.research.att.com/~smb
>
References: