Subject: [Hipsec] Resolving the SPI question, or splitting ESP out of base spec

From: [email-masked] (Henderson, Thomas R)
Date: Wed Nov 17 11:44:01 2004

=20

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]]=20
> Sent: Monday, November 15, 2004 12:31 PM
> To: [email-masked]
> Subject: [Hipsec] Resolving the SPI question, or splitting=20
> ESP out of base spec
>=20
> And as a logical consequence of this,
>=20
>    What if we split out all concerning ESP from the base
>    specification, and make it a (mandatory) extension?
>=20

As I just posted on the thread on the RG list, I agree that this
does seem consistent if one adopts the viewpoint that ESP is not
"core" HIP.  There have been various suggestions and proposals
to consider HIP without ESP, for lightweight reasons (lightweight
HIP) or because it conflicts/duplicates a more efficient encryption
scheme (secure RTP).

Also, regarding ESP, in section 11.5 of base spec the use of ESP
NULL is a "SHOULD NOT", but there may be valid reasons to use just
ESP authentication.  I discussed this with Bob at the meeting and
he said that he did not intend for ESP NULL to only be a debugging
mode.

Tom