Subject: RE: header and data digest issue

From: [email-masked]
Date: Wed, 27 Feb 2002 20:13:28 -0500

> >For the middlebox problem, ESP cryptographic integrity is the right
> >solution,
> 
> Technically, ESP isn't necessary.  AH between the iSCSI endpoints is
> adequate if the only requirement is to detect and defeat middle boxes.

We're in semi-violent agreement that encryption isn't required.  For
"ESP cryptographic integrity", one example is ESP with the NULL
Encryption Algorithm, as specified in RFC 2410.  AH is not required
for any IP Storage protocol and the ipsec WG is in the process of
removing the requirement for AH from future versions of the ipsec RFCs.

--David
---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 249-6449 *NEW*      FAX: +1 (508) 497-8500
[email-masked]         Cell: +1 (978) 394-7754
---------------------------------------------------

---

From: Jonathan Stone <[email-masked]>
Date: Thu, 28 Feb 2002 15:12:33 -0800

>removing the requirement for AH from future versions of the ipsec RFCs.

... modulo IP header authentication and NATs. (iir, AH verifies the IP
header; ESP+Null enc+ Auth doesn't, or only via the TCP pseudo-header
checksum).  You and I are in fierce agreement; previous posters may
not be entirely happy with prospects of NATting ESP.

Given the issues with standards-track progress and in-progress IPsec
work, do the IPS security drafts explicilty make clear the rationale
for not requiring AH support?  The lastest ips-security draft
(http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-11.txt)
still cites rfc2402.  Should that be excised?