| Main Archive Page > Month Archives > ipsec archives |
Re: [IPsec] AD review comments for draft-ietf-ipsecme-traffic-visibility
From: Tero Kivinen <kivinen_at_nospam>Date: Mon Sep 21 2009 - 11:13:45 GMT
To: "Grewal, Ken" <ken.grewal@intel.com>
Grewal, Ken writes:
> >- A question: did the WG discuss the pros and cons of integrity
> >protecting the WESP header? (This does make WESP more complex to
> >implement, and currently the WESP header does not contain any data
> >that would benefit from integrity protection in any way.)
> [Ken] This change was the result of a discussion on threats posed by
> 'malware', which could modify the WESP headers to obfuscate the
> payload from inspection by intermediate nodes such as IDS/IPS
> systems.
> The issue (ticket #104) was raised and closed some time back after
> lengthy discussions on the topic.
> http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/104
As everything in the WESP header is something that can be verified by the recipient node why is the integrity protection needed?
I think it would make implementation WESP much easier if it can be done as post processing step after ESP has been applied, in a similar way UDP encapsulation can be done to the ESP packet. -- kivinen@iki.fi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec