Subject: RE: [Ipsec] Layer 2 processing inside IPsec

From: [email-masked]
Date: Wed, 30 Jun 2004 20:10:08 +0200

I summarize hereafter the main points that arise from the different messages
posted to this list :
  - Combining ROHC (or whichever generic compression frameworks suits) and
IPsec in an efficient way leads to an integration of ROHC in the middle of
IPsec. From the IPsec framework point of view, this could take the form ESP
used in tunnel mode, but with a specific "next header" value different from
"IP", in order for the policy enforcement processing to take place just
after decryption and decompression, along the lines of what Jan Vilhuber
proposed.
  - If a layer 2 processing such as ROHC is tunneled (directly or not) over
IP, one must be careful regarding packet re-ordering. This kind of problem
is dealt with by other layer 2 tunneling frameworks, such as L2TP. Just take
a look at Appendix C of the present L2PTv3 draft
(http://www.ietf.org/internet-drafts/draft-ietf-l2tpext-l2tp-base-11.txt),
which pinpoints this issue more accurately than RFC 2661. I agree this
problem is not easy to tackle, especially when one wants to determine the
"very short period" after which a missing sequence number is considered lost
rather than misordered ...

F. Paul

-----Message d'origine-----
De : Francis Dupont [mailto:[email-masked]]
Envoye : lundi 28 juin 2004 22:50
A : [email-masked]
Cc : [email-masked]; [email-masked]
Objet : Re: [Ipsec] Layer 2 processing inside IPsec 

 In your previous mail you wrote:

   > I disagree: IPsec does not change the order 
   
   That's not at all clear to me.  
   
=> this is misunderstanding: IPsec itself doesn't change the order,
IP can change it and is run under IPsec.

   you cannot naively use ROHC over IPsec.

=> I agree. BTW I am not interested by ROHC itself but by any
compression which can work with IPsec. In fact I believe it still
has to be designed/specified.
   
   An integrated IPsec - ROHC implementation could look at the IPsec
   sequence number and insert its own reorder buffer, but such an
   integration would not be as simple as defining an IP protocol number
   for ROHC.
   
=> nothing can be simple with ROHC (:-). IMHO we talk about ROHC
just because it is the more sophisticated compression...

   It's an architectural issue.  An integrated IPsec-ROHC means that the
   ROHC would have to be inserted into the *middle* of IPsec processing,
   between the policy enforcement part and the encryption part.  
   
=> it seems we agree: something can be done but needs real work.

Thanks

[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 30 Jun 2004 14:35:33 -0400

one additional point: the header compression schemes i'm familiar with
all involve inter-packet dependancies.  

If someone is particularly serious about integrating IPsec and ROHC,
another thing worth looking at is whether an the integrity protection
provided by an esp-rohc combination might well be significantly
enhanced by doing a MAC over the pre-compressed packet rather than/in
addition to the current MAC over the ciphertext...

(yes, this is a fairly significant change to ESP...)

					- Bill

---

From: Jan Vilhuber <[email-masked]>
Date: Wed, 30 Jun 2004 12:34:02 -0700 (PDT)

> If someone is particularly serious about integrating IPsec and ROHC,

I admit I'm not terribly interested in ROHC. I don't know too much
about it, but I didn't want to exclude it from my draft either.

> addition to the current MAC over the ciphertext...

Yes, I'd thought about that before, too. If we were free to change the
semantics and functioning of ESP, there's a few more thigns I recall I
was thinking about at the time (my memory is suffering, since this was
a while ago), but I think we'll want to stay within the confines of
the semantics of ESP for now.

jan

 --
Jan Vilhuber                                            [email-masked]
Cisco Systems, San Jose                                     (408) 527-0847