[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Simplifying IKE
In your previous mail you wrote:
AH or not-AH has nothing to do with VPN or end-to-end IPsec use.
=> the sub-thread is more about ESP tunnel mode vs. others.
VPNs don't need AH at all, even you can do AH in tunnel mode this
just adds bits for no benefit. Tunnel mode for end-to-end IPsec
adds bits and removes some properties (cf your next statement).
As Steve Bellovin has pointed out on numerous occasions, the IP header
in transport-mode ESP can be "authenticated" merely by doing a compare
of the source and destination addresses against static state in the
SA...
=> this "authentication" by side effect is mandatory according to RFC
2401 5.2.1 step 2 but:
- it doesn't work with tunnel mode
- it covers only the source address, not enough for interesting cases
like MIPv6 BUs (where both the care-of and the home addresses
(two source addresses) have to be protected).
I believe this is why AH is useful only for IPv6 (IPv4 options are
not used/usable: no need to protect them).
Regards
Francis.Dupont@enst-bretagne.fr
Follow-Ups:
References: