Subject: RE: Should CGA parameters be a separate header instead of being i ntegrated with AH

From: Soliman Hesham <[email-masked]>
Date: Mon, 16 Jun 2003 22:18:25 -0400

> Soliman Hesham wrote:
 > > Perhaps we don't need a "CGA extension header", couldn't
 > > we just use a DST options header which can be located
 > > before IPsec headers? 
 > 
 > Well, technically it could, but I doubt the benefit from that.
 > Firstly, the total size of the packet would be slightly larger.

=> Not sure I got that. The only difference is the value
of the 'type' field right?

 > Secondly, it would be technically easier to plug in a new
 > extension header to a live kernel than a new DST OPT.
 > Thirdly, it would have to be a mandatory DST OPT or else the
 > next step (AH / ESP / HIP verification) would fail.  

=> By 'mandatory' you mean it has to exist in the packet right?
Of course, the same would happen for either header.
I just think that we should only define new header types when 
we have to.

Thus, I
 > don't see any real benefit.
 > 
 > A new extension header would have the nice benefit that you
 > get a clean ICMP Parameter Problem error message.  Well, you
 > would also get one from a DST OPT, too.  Hmm.  Maybe there would
 > be differences if the CGA ext header is sent to a multicast
 > destionation.  I have to think about this.

=> Ok

Hesham
--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 17 Jun 2003 10:25:42 +0300

> of the 'type' field right?

Let's see.  I'm assuming now a full KMP-like CGA, with the
ability to create a short lived AH SA.

Separate extension header:

  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  | Next Header   |  Hdr Ext Len  | RES | PAD |CC |  Algorithm    |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                         SA lifetime                           |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  +                           Timestamp                           +
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  +                                                               +
  |                            Modifier                           |
  +                                                               +
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  .                          Public key                           .
  .                      (variable length)                        .
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Destination option:

  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |  Next Header  |  Hdr Ext Len  |  Option Type  | Opt Data Len  |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |   Algorithm   |     |CC |             Reserved                |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  +                           Timestamp                           +
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  +                                                               +
  |                            Modifier                           |
  +                                                               +
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                         SA lifetime                           |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  .                          Public key                           .
  .                      (variable length)                        .
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

No big difference in actual length (4 bytes).  However, the option
data length is limited to 255 bytes, limiting the maximum size
of the public key to approximately 227 bytes, meaning that the
maximum RSA key size would be about 1760 bits.

Thus, I think that the limitation on the maximum key size warrants
alone a separate extension header.

--Pekka