Subject: RE: [Ipsec] Layer 2 processing inside IPsec

From: [email-masked]
Date: Fri, 2 Jul 2004 18:26:07 +0200

This is the reason why it is proposed to insert decompression *between*
decryption and policy enforcement. Once the encrypted payload is decrypted,
if the "next header" field shows that it is a ROHC-compressed packet, the
appropriate decompressor is applied, which produces a regular IPv4 or IPv6
packet header. Then, the classical IPsec access control checks are applied.

This is described in details in Jan Vilhuber's proposal, though the present
draft invokes compression schemes (not so) different from ROHC.

F. Paul

-----Message d'origine-----
De : Stephen Kent [mailto:[email-masked]]
Envoye : vendredi 2 juillet 2004 16:15
A : [email-masked]
Cc : [email-masked]; [email-masked];
[email-masked]
Objet : RE: [Ipsec] Layer 2 processing inside IPsec

At 8:10 PM +0200 6/30/04, [email-masked] wrote:
>I summarize hereafter the main points that arise from the different
messages
>posted to this list :
>   - Combining ROHC (or whichever generic compression frameworks suits) and
>IPsec in an efficient way leads to an integration of ROHC in the middle of
>IPsec. From the IPsec framework point of view, this could take the form ESP
>used in tunnel mode, but with a specific "next header" value different from
>"IP", in order for the policy enforcement processing to take place just
>after decryption and decompression, along the lines of what Jan Vilhuber
>proposed.

tunnel mode requires that the next header be IP (v4 or v6) because 
that header is used for the access control checks. So I don't 
understand your description above.

Steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 2 Jul 2004 13:41:18 -0400

>draft invokes compression schemes (not so) different from ROHC.

Thanks for the clarification. it was just the choice of words that 
made it confusing to me.  Look at the new processing model in 
2401bis, and see how you would describe the processing in that 
context, to make sure this is consistent with that model.

Steve