Re: NAT Traversal

[Henry Spencer <henry@spsystems.net>]

On Fri, 1 Mar 2002, Tero Kivinen wrote:
> > There is no such thing as a (standard conforming) TCP/UDP stack which does
> > not care about checksums...
> 
> Note, that we are talking about packets which are already verified
> using the MAC of the ESP payload.

That verifies that they have not been damaged between the time they were
encrypted and the time they were decrypted.  That is *NOT* a substitute
for the end-to-end check provided by the checksums.  The encryption and
decryption points are not necessarily the ends.

(Bad enough that you have to somehow indicate to the final destination
that it shouldn't bother with the checksum... but how do you catch damage
done while the packet was in transit from the original sender to the
encryption point?)

It is very, very, very important that the checksums are END TO END checks,
computed by the original sender and checked by the final destination.

                                                          Henry Spencer
                                                       henry@spsystems.net