Subject: [IPsec] I-D ACTION:draft-ietf-ipsecme-traffic-visibility-00.txt

From: [email-masked]
Date: Mon, 27 Oct 2008 14:30:02 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the IP Security Maintenance and Extensions Working Group of the IETF.

	Title		: Wrapped ESP for Traffic Visibility 
	Author(s)	: K. Grewal, G. Montenegro
	Filename	: draft-ietf-ipsecme-traffic-visibility-00.txt
	Pages		: 10
	Date		: 2008-10-22
	
This document describes an ESP encapsulation for IPsec, allowing 
   intermediate devices to ascertain if ESP-NULL is being employed 
   and hence inspect the IPsec packets for network monitoring and 
   access control functions.  Currently in the IPsec standard, 
   there is no way to differentiate between ESP encryption and ESP 
   NULL encryption by simply examining a packet. 

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-traffic-visibility-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 28 Oct 2008 13:32:21 +0200

Ken, Gabriel, thanks for posting this draft.

I'd like to reopen the discussion about the "integrity only" bit, which
disappeared since the previous version of this draft.

Having this bit in the header means that Wrapped ESP (WESP) can encode both
authenticated-only and authenticated-and-encrypted ESP.

I see some benefits to allowing this option, and frankly, I don't see the
drawbacks.

- The main thing is extensibility. Existing ESP does not have any (which is
why we're going through this exercise). WESP has at least a few unencrypted
reserved bits which we can utilize for future needs.
- Also, having the exact same semantics for WESP as for ESP might simplify
code, test vectors etc. But complexity arguments are always weak :-)

Thanks,
	Yaron

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Monday, October 27, 2008 23:30
To: [email-masked]
Cc: [email-masked]
Subject: [IPsec] I-D ACTION:draft-ietf-ipsecme-traffic-visibility-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the IP Security Maintenance and Extensions
Working Group of the IETF.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-traffic-visibility-00
.txt

---

From: Michael Bowler <[email-masked]>
Date: Tue, 28 Oct 2008 09:52:11 -0400

A few comments questions...

- An 8 octet header would be much more friendly with IPv6.
- HdrLen and TrailerLen should have units defined.
- Is there any security concern by providing TrailerLen in the clear? 
Normal ESP encrypts this value.
- I do not see how this header is useful if there is no flag indicating 
that the payload is encrypted or not.

Regards,

Michael

-- 
Michael Bowler                                [email-masked]
Sr. IC Designer/Architect                           (613) 254-5456x107
Elliptic Semiconductor                            www.ellipticsemi.com
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec