Subject: RE: [tcpm] new internet draft - drafft-touch-anonsec

From: "Christian Huitema" <[email-masked]>
Date: Thu, 6 May 2004 13:41:15 -0700

> i.e., Trudy sends a packet with her SPI (SPI2) to Alice, but in the
inner
> packet she sends a packet which has IP address of Alice and Bob and
TCP
> ports of Alice and Bob. Please also note that Trudy can use just one
SPI2
> to attack hundreds of TCP connection that might originate from Alice.

What you are saying is that one cannot really protect TCP with
tunnel-mode IPSEC. Duh. Use transport mode.

-- Christian Huitema

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Thu, 06 May 2004 13:48:29 -0700

> tunnel-mode IPSEC. Duh. Use transport mode.

Even tunnel mode is supposed to check the outer packet headers. IPsec AH 
authenticates the outer IP header regardless.

Joe

---

From: Joe Touch <[email-masked]>
Date: Thu, 06 May 2004 14:07:18 -0700

> authenticates the outer IP header regardless.
                     ^^^^^
                     inner

Presuming, as Christian also observes, reasonable policies.