Subject: [Ipsec] draft-ietf-ipsec-rfc2402bis-07.txt ... Suggest moving the "Flow Label" IPv6 base header field to "immutable" and protecting with AH

From: "John Spence, CCSI, CCNA, CISSP" <[email-masked]>
Date: Fri, 3 Sep 2004 08:12:00 -0700

The flow label in IPv6 is chosen by the source node, and must be delivered
to the ultimate destination without having been changed in transit, unlike
the DSCP or ECN QoS-related fields for IPv6.

I suggest, since it is constant end-to-end, the field be moved to
"immutable" and protected by AH.

-------------- from draft-ietf-ipsec-rfc2402bis-07 ----------

3.3.3.1.2.1  Base Header Fields

   The IPv6 base header fields are classified as follows:

   Immutable
             Version
             Payload Length
             Next Header
             Source Address
             Destination Address (without Routing Extension Header)

   Mutable but predictable
             Destination Address (with Routing Extension Header)

   Mutable (zeroed prior to ICV calculation)
             DSCP (6 bits, see RFC2474 [NBBB98])
             ECN (2 bits, see RFC3168 [RFB01])
             Flow Label
             Hop Limit

-------------- from RFC 3697 --------------

2.  IPv6 Flow Label Specification

   The 20-bit Flow Label field in the IPv6 header [IPv6] is used by a
   source to label packets of a flow.  A Flow Label of zero is used to
   indicate packets not part of any flow.  Packet classifiers use the
   triplet of Flow Label, Source Address, and Destination Address fields
   to identify which flow a particular packet belongs to.  Packets are
   processed in a flow-specific manner by the nodes that have been set
   up with flow-specific state.  The nature of the specific treatment
   and the methods for the flow state establishment are out of scope for
   this specification.

   The Flow Label value set by the source MUST be delivered unchanged to
   the destination node(s).

-------------------------------
John Spence, CCSI, CCNA, CISSP
Native6, Inc.
IPv6 Training and Consulting
[email-masked]
www.native6.com
-------------------------------

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 3 Sep 2004 12:45:18 -0400

>"immutable" and protected by AH.

John,

We copied the text from 2402, and nobody had noticed the error there 
in almost 6 years! Good catch.

We will change the 2402bis text accordingly.

Thanks,

Steve

---

From: Francis Dupont <[email-masked]>
Date: Sat, 04 Sep 2004 00:47:20 +0200

=> Please check with the IPv6 WG. BTW this is not an error, the flow
label was specified in details only by RFC 3697 (published in Mars).
BTW, there is no real need to protect the flow label (look at the
RFC 3697 security considerations for attacks based on altered flow
labels) and for compatibility with current IPv6/IPsec implementations
I *really* prefer we keep the current situation, i.e., flow label
field *not* in "immutable".

Thanks

[email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Thu, 9 Sep 2004 14:58:36 -0400

Francis,

I looked at RFC 3697.  It does state that AH does not protect flow 
labels, which is consistent with the old AH spec (RFC 2402). So, if 
we were to change this in the new AH spec, there would be a conflict. 
Also, the security analysis in 3697 argues that since there is no 
protection of the flow spec value, intermediate systems cannot rely 
on it and an end IPsec implementation cannot rely on it in transport 
mode.  I agree that it is unlikely that we would be able to manage 
key distribution for intermediate systems to be able to check the AH 
ICV, which supports your argument that it is not worth including it 
in the ICV computation.
However, if we choose to maintain backward compatibility with 2402, 
we need to clarify in 2402bis that this is the reason for not 
including the value in the ICV computation, as opposed to the 
current, erroneous rationale.

Is the WG comfortable with the status quo, i.e., NOT including the 
flow label in the ICV, despite the fact that it is immutable?

Steve