Re: data origin authentication

[Henry Spencer <henry@spsystems.net>]

On Tue, 7 May 2002, Goeman Stefan wrote:
> ...I is correct to say
> that if ESP is used in transport mode, there is no data origin
> authentication? I would say this because
> the IP header, containing the source IP address is not authenticated.

Not really correct.  Yes, the header may be tampered with... but the
origin of the *data* (the packet contents) is still certain, because only
someone knowing the authentication key can generate a packet which will
pass authentication. 

The header is just the means by which the data is conveyed to the
destination.  Usually, one cares about authenticating the contents, not
the header. 

                                                          Henry Spencer
                                                       henry@spsystems.net