Subject: [Ipsec] IPsec -- AH draft

From: Karen Seo <[email-masked]>
Date: Mon, 6 Dec 2004 01:53:23 -0500

Folks,

Based on the November exchange on the IPsec list re: AH and ICV and 
padding (see emails on subject "Query for IPv6 ICV" starting 
11/4/04), we have submitted a new AH draft.  This has been modified 
as shown below to clarify that in addition to the existing 
requirement to pad the ICV such that the whole AH length is an 
integral multiple of 4 (IPv4) or 8 (IPv6), unnecessary padding is 
prohibited.  We did not modify any paragraphs involving *implicit* 
padding on the assumption that the relevant algorithm document should 
specify the padding requirements appropriately.

	2.6  Integrity Check Value (ICV)

	This is a variable-length field that contains the Integrity
	Check Value (ICV) for this packet.  The field must be an
	integral multiple of 32 bits (IPv4 or IPv6) in length. The
	details of ICV processing are described in Section 3.3.3
	"Integrity Check Value Calculation" and Section 3.4.4
	"Integrity Check Value Verification." This field may include
	explicit padding, if required to ensure that the length of
	the AH header is an integral multiple of 32 bits (IPv4) or
	64 bits (IPv6). All implementations MUST support such
	padding     . Details of how to compute the required padding
	        ^^^^
                 insert text --> and MUST insert only enough padding
	        to satisfy IPv4/v6 alignment requirements.

	length are provided below in Section 3.3.3.2 "Padding".
	The integrity algorithm specification MUST specify the length
	of the ICV and the comparison rules and processing steps for
	validation.

	3.3.3.2.1  ICV Padding

	As mentioned in section 2.6, the ICV field may include
	explicit padding if required to ensure that the AH header
	is a multiple of 32 bits (IPv4) or 64 bits (IPv6). If
	padding is required, its length is determined by two factors:
		- the length of the ICV
		- the IP protocol version (v4 or v6)

	For example, if the output of the selected algorithm is
	96-bits, no padding is required for either IPv4 or for IPv6.
	However, if a different length ICV is generated, due to use
	of a different algorithm, then padding may be required
	depending on the length and IP protocol version.  The
	content of the padding field is arbitrarily selected by the
	sender.  (The padding is arbitrary, but need not be random
	to achieve security.)  These padding bytes are included in
	the ICV calculation, counted as part of the Payload Length,
	and transmitted at the end of the ICV field to enable the
	receiver to perform the ICV calculation.
                                                  ^^^^
	                                      add text: Inclusion of
	padding in excess of the minimnal amount required to satisfy
	IPv4/v6 alignment requirements is prohibited.

Thank you,
Karen

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec