Thanks Qiu Ying - great observation. We had originally proposed using a bit from the WESP flags (integrity only) for differentiating between ESP-encrypted and ESP-NULL traffic, but changed this to using a value of zero in the next header for efficient encoding, although this is overloading the meaning of next header. With your observation, the current definition is not practical so we have the following options:
1. Revert back to using a bit in the flags to differentiate between encrypted / NULL traffic. 2. Allocate a new protocol value for the next header field to indicate encrypted data, which seems like an overkill. As we are already asking for a new protocol value for WESP, option 1 seems to be the better choice. Other opinions? Thanks, - Ken ________________________________ From: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf Of QIU Ying Sent: Tuesday, July 14, 2009 12:37 AM To: QIU Ying; Yaron Sheffer; ipsec@ietf.org Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05 Since the zero of next header value is used for HOPOPT already, maybe applying a new value for this intention is better to avoid the confliction. Regards Qiu Ying ----- Original Message ----- From: QIU Ying<mailto:qiuy...@i2r.a-star.edu.sg> To: Yaron Sheffer<mailto:yar...@checkpoint.com> ; ipsec@ietf.org<mailto:ipsec@ietf.org> Sent: Tuesday, July 14, 2009 3:30 PM Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05 Regarding the Next Header in section 2, what will be happened if the value of Next Header is zero (i.e. IPv6 Hop-by-Hop option) and the packet is not encrypted? Regards Qiu Ying ----- Original Message ----- From: Yaron Sheffer<mailto:yar...@checkpoint.com> To: ipsec@ietf.org<mailto:ipsec@ietf.org> Sent: Sunday, July 05, 2009 3:48 AM Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05 This is the beginning of a two-week WG Last Call, which will end July 18. The target status for this document is Proposed Standard. The current document is at http://tools.ietf.org/html/draft-ietf-ipsecme-traffic-visibility-05. If you have not read the document before now, please do so. Having fresh eyes on the document often brings up important issues. If you HAVE read it before, please note that there have been several revisions since San Francisco, so you might want to read it again (plus it's a short document). Send any comments to the list, even if they are as simple as "I read it and it seems fine". Please clearly indicate the position of any issue in the Internet Draft, and if possible provide alternative text. Please also indicate the nature or severity of the error or correction, e.g. major technical, minor technical, nit, so that we can quickly judge the extent of problems with the document. Thanks, Yaron ________________________________ _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec Institute for Infocomm Research disclaimer: "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."
_______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec
