RE: ESP+AH

[Rick Smith at Secure Computing <rick_smith@securecomputing.com>]

At 06:08 PM 5/8/2002, Russell Harrison wrote:

> Irrespective of the ordering of the proposal, the only way it
>makes sense to apply both AH and ESP is [AH][ESP].

In a truly practical sense, I don't think it matters which way you do it. You loose a smidgin of benefit either way. 

Years back in "Internet Cryptography" I suggested that [AH][ESP] makes the most sense since it makes it possible for a gateway to authenticate a packet without knowing how to decrypt it (tho' I don't know of anyone who ever made use of this capability). Implementers also liked this approach since it let you validate the ciphertext integrity before handing it to the crypto modules which, in the early days, were unnecessarily fragile.

On the other hand, a crypto purist would argue that you get weaker authentication with [AH][ESP]. It's only authenticating the ciphertext. In theory, this could allow you to change the plaintext by varying the encryption process and the changed plaintext wouldn't be detected by the AH.

Of course, this is largely a theoretical concern. It's not immediately clear what an attacker has to gain from this, nor is it clear that this is feasible in any real world IPSEC implementations.


Rick.
smith@securecomputing.com            roseville, minnesota
"Authentication" in bookstores http://www.visi.com/crypto/