At 12:27 AM +0200 1/5/10, Yaron Sheffer wrote:
Hi,
We have had a few "discusses" during the IESG review of the WESP
draft. To help resolve them, we would like to reopen the following
two questions to WG discussion. Well reasoned answers are certainly
appreciated. But plain "yes" or "no" would also be useful in judging
the group's consensus.
- The current draft
(http://tools.ietf.org/html/draft-ietf-ipsecme-traffic-visibility-11)
defines the ESP trailer's ICV calculation to include the WESP
header. This has been done to counter certain attacks, but it means
that WESP is no longer a simple wrapper around ESP - ESP itself is
modified. Do you support this design decision?
My previous message describing why I think the current design is
seriously flawed provided the rationale for my NO response to this
question. WESP as a modular, separate, nested protocol would be
preferable.
- The current draft allows WESP to be applied to encrypted ESP
flows, in addition to the originally specified ESP-null. This was
intended so that encrypted flows can benefit from the future
extensibility offered by WESP. But arguably, it positions WESP as an
alternative to ESP. Do you support this design decision?
I am concerned about the wording of the penultimate sentence above.
Several folks argued against applying WESP to encrypted traffic and
they cited various reasons for why this might be inappropriate. You
did not choose to cite those reasons, which I think may bias
responses. I think the two major issues cited re the extension of
WESP to encrypted traffic are:
- it is formally outside the charter
- no good WESP extensions have been proposed for encrypted traffic
Even if WESP is approved for use with encrypted traffic, that does
not mean that it will supplant ESP. ESP still has a smaller header
than WESP, so for environments where there is no intent to
accommodate middlebox snooping, ESP is still preferable.
So, NO to this question as well.
Steve
_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec
