RE: data origin authentication

[Henry Spencer <henry@spsystems.net>]

On Tue, 7 May 2002, Goeman Stefan wrote:
> > Usually, one cares about authenticating the contents, not the header. 
> 
> If you don't really need to authenticate the header to obtain data origin
> authentication, why does AH (rfc 2402) authenticates also the IP header,
> and not only the IP payload?

Well, you'll note that I said "usually".  There are situations where you
would like to be able to trust certain items in the header.  For example,
in multicast applications, the source address may not be uniquely
determined by the SA used, and might be significant to the user-level code.

That said, there are many people who think that this feature of AH was
a design mistake, and that the entire AH protocol is now superfluous and
should be removed from IPsec and reclassified as Historic.  (There are
other people who disagree.)

                                                          Henry Spencer
                                                       henry@spsystems.net