Subject: [tcpm] securing TCP using IPsec with cookies

From: Joe Touch <[email-masked]>
Date: Fri, 23 Apr 2004 11:51:43 -0700

Hi, all,

In an earlier message, I wondered whether it would be useful to consider 
a 'cookie mode' to IPsec.

I believe, FWIW, that a null-mode algorithm will suffice. The SPI 
becomes the shared cookie, and no further packet processing occurs.

Currently 2401 prohibits use of null-mode; only one of either encryption 
or authentication can be null. That might be something that can be 
revisited in the Security Area, since its use would be appropriate for 
avoiding all but man-in-the-middle spoofing.

Joe