Subject: [IPsec] IPSec, ESP and AH authentication

From: Tjeu <[email-masked]>
Date: Tue, 9 Oct 2007 06:26:57 -0700 (PDT)

Dear All,
 
As you might know, IPSec ESP authentication does not authenticate the
destination and source
addresses of the IP header, whereas the IPSec AH authentication does(i.e.
calculatec MAC over them). However, both claim that they offer data origin
authentication. It is not clear for me how the ESP authentication offers
data origin authentication, as the MAC is not computed on the source and
dest addresses. Therefore the attacker could easily modify them. Am I
missing something ? I would be thankful if anyone could provide links where
I could read regarding this subject, in more details. I looked through some
RFC's but they dont seem to help.

Thanks,

Tjeu
-- 
View this message in context: http://www.nabble.com/IPSec%2C-ESP-and-AH-authentication-tf4594212.html#a13115564
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

xim 4.43) id 1IfF6v-0002X8-Ex
	for [email-masked]; Tue, 09 Oct 2007 09:26:57 -0400
Date: Tue, 9 Oct 2007 06:26:57 -0700 (PDT)
From: Tjeu <[email-masked]>
To: [email-masked]
Subject: [IPsec] IPSec, ESP and AH authentication

Dear All,
 
As you might know, IPSec ESP authentication does not authenticate the
destination and source
addresses of the IP header, whereas the IPSec AH authentication does(i.e.
calculatec MAC over them). However, both claim that they offer data origin
authentication. It is not clear for me how the ESP authentication offers
data origin authentication, as the MAC is not computed on the source and
dest addresses. Therefore the attacker could easily modify them. Am I
missing something ? I would be thankful if anyone could provide links where
I could read regarding this subject, in more details. I looked through some
RFC's but they dont seem to help.

Thanks,

Tjeu
-- 
View this message in context: http://www.nabble.com/IPSec%2C-ESP-and-AH-authentication-tf4594212.html#a13115564
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 9 Oct 2007 23:43:45 +0000

On Tue, 9 Oct 2007 06:26:57 -0700 (PDT)
Tjeu <[email-masked]> wrote:

> addresses of the IP header, whereas the IPSec AH authentication
> does(i.e. calculatec MAC over them). However, both claim that they
> offer data origin authentication. It is not clear for me how the ESP
> authentication offers data origin authentication, as the MAC is not
> computed on the source and dest addresses. Therefore the attacker
> could easily modify them. Am I missing something ? I would be
> thankful if anyone could provide links where I could read regarding
> this subject, in more details. I looked through some RFC's but they
> dont seem to help.
> 
Put the IP addresses in the SPD, and derive that in turn from the
authenticated identity.  If the attacker modifies them, the packet will
be dropped because it won't match the SPD.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: ns srinivasa murthy <[email-masked]>
Date: Wed, 10 Oct 2007 13:17:45 +0530

In tunnel mode ESP ,the inner IP header is protected and as such no 
one can change the source IP in between.This inner IP packet is the 
actual data packet and its source IP can not be changed.So Data 
origin Authentication is supported in tunnel mode ESP.

Even if the outer Source IP is changed in between,the attacker can 
not do any harm.The implementation has to take care that the out 
going ESP traffic is sent only to the tunnel end point detected as 
part of IKE negotiation.

-nsmurthy

>                 --Steve Bellovin, http://www.cs.columbia.edu/~smb

********************************************************************************
This email message (including any attachments) is for the sole use of the intended recipient(s) 
and may contain confidential, proprietary and privileged information. Any unauthorized review, 
use, disclosure or distribution is prohibited. If you are not the intended recipient, 
please immediately notify the sender by reply email and destroy all copies of the original message. 
Thank you.
 
Intoto Inc.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 19 Oct 2007 17:17:27 -0400

>RFC's but they dont seem to help.

IPsec ESP does provide data origin authentication.  Maybe IPSec doesn't :-).

(Note the correct spelling of the architecture.)

Steve