Subject: Re: [IPsec] I-D Action:draft-ietf-ipsecme-esp-null-heuristics-00.txt

From: Tero Kivinen <[email-masked]>
Date: Tue, 7 Jul 2009 22:36:46 +0300

Paul Hoffman writes:
> >	Title           : Heuristics for Detecting ESP-NULL packets
> Soooo, that was two months ago, and there has been no discussion.
> Has anyone other than the document authors (and the WESP authors)
> read the document? Does the WG find this to be useful? 
> 
> Tero and Dan: have you found anything that you want to change?

We did receive few comments that might be added to the draft, those
were about the GCM IV (i.e. they might not be random, but might be
counter, which means they might have lots of zeroes in the beginning,
and that might affect the heuristics a bit), and another were about
adding some section about how end-nodes can make small changes to make
the heuristics more efficient (i.e. use more than minimal number of
padding, for first few packets for new SA, and make sure GCM IVs look
random enough, so they cannot be confused for TCP or UDP headers). 

I have not made those changes, as I am not sure if we want to even add
both of them. I was mostly waiting for more comments and then think
again about whether to add those or not.

Ps. I am currently on vacation until IETF, so I am reading my emails
very randomly...
-- 
[email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 7 Jul 2009 23:13:02 +0300

Hi Tero,

We have one working group draft dealing with new ESP-null implementations.
We have another draft dealing with unchanged ESP-null implementations. I
suggest we don't confuse everybody by adding a third category:
just-a-little-tiny-bit changed implementations. In other words, I think the
second change is *not* a good idea.

Thanks,
	Yaron

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Tero Kivinen
> Sent: Tuesday, July 07, 2009 22:37
> To: Paul Hoffman
> Cc: [email-masked]
> Subject: Re: [IPsec] I-D Action:draft-ietf-ipsecme-esp-null-heuristics-
> 00.txt
> 
> Paul Hoffman writes:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
> 
> Scanned by Check Point Total Security Gateway.

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 7 Jul 2009 23:39:54 +0300

> second change is *not* a good idea.

Partly agree, which is why I have not yet added that to the document.

On the other hand "just-a-little-tiny-bit" change is something that
does not break interoperability, i.e. even if sender does those
changes, complient recipients will be able to process packets
normally, as they are still completely valid ESP packets, only
difference is that sender decided to use the option in ESP where you
can add more padding if you want, and/or decided to select GCM IVs in
a way which makes them look like random. Both of those implementation
hints would be something that would not require any changes for the
recipient. That is why I haven't already completely ruled out adding
that kind of implementation hints for sender section to future drafts.
-- 
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 7 Jul 2009 13:50:46 -0700

At 11:13 PM +0300 7/7/09, Yaron Sheffer wrote:
>Content-Language: en-US

Fully agree.

--Paul Hoffman, Director
--VPN Consortium