Subject: [IPsec] I-D Action:draft-ietf-ipsecme-esp-null-heuristics-04.txt

From: [email-masked]
Date: Wed, 27 Jan 2010 06:45:02 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Security Maintenance and Extensions Working Group of the IETF.

	Title           : Heuristics for Detecting ESP-NULL packets
	Author(s)       : T. Kivinen, D. McDonald
	Filename        : draft-ietf-ipsecme-esp-null-heuristics-04.txt
	Pages           : 37
	Date            : 2010-01-27

This document describes a set of heuristics for distinguishing IPsec
ESP-NULL (Encapsulating Security Payload without encryption) packets
from encrypted ESP packets.  These heuristics can be used on
intermediate devices, like traffic analyzers, and deep inspection
engines, to quickly decide whether given packet flow is interesting
or not.  Use of these heuristics does not require any changes made on
existing RFC4303 compliant IPsec hosts.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-esp-null-heuristics-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Jack Kohn <[email-masked]>
Date: Thu, 28 Jan 2010 05:48:04 +0530

Hi,

Do folks have to implement this RFC since its of the INFORMATIONAL type?

If Yes, then i would like some sort of resolution to the issues raised in
http://www.ietf.org/mail-archive/web/ipsec/current/msg05471.html

As a developer i would like to understand as to how i am required to
do cache management, etc and some pointers to this effect would be
appreciated.

I also think that we need to mention that this does open up a window
for DoS attacks as explained in the above post in the Security
Considerations section.

Jack

On Wed, Jan 27, 2010 at 8:15 PM,  <[email-masked]> wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>
>

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 27 Jan 2010 17:22:03 -0800

>Do folks have to implement this RFC since its of the INFORMATIONAL type?

No one has to implement anything, ever. You don't have implement every IETF standard, only the ones you want. To be clear: I'm not being facetious. The fact that something is on standards track or is experimental or informational is not correlated to whether or not you want to implement it.

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 28 Jan 2010 13:14:03 +0200

> Do folks have to implement this RFC since its of the INFORMATIONAL

No, and same applies to WESP. You need either (or both) them only and
only if you operate in enviroments where they are suitable, and where
you require features provided by them. 

> http://www.ietf.org/mail-archive/web/ipsec/current/msg05471.html

I do not see any explicit issues raised in the that email, mostly I
see comments saying mixing up TCP/UDP flows (which can be short lived)
and IPsec flows (which usually are not short lived), and comments that
it is not suitable for certain limited platforms.

> do cache management, etc and some pointers to this effect would be

This is engineering problem that does not really affect the heuristics
that much, and there is lots of algorithms that can be used there.
Which of them is best depends quite a lot about the network
environments. In some environments one alrogithm works best, and on
some other environments some other algorithm is better.

There are already devices which solve much harder problems, for
example deep inspection engine devices (intrusion detection and/or
preventation systems). The problems they solve are much harder than
what heuristics needs to do as they need to keep track on each UDP and
TCP flow separately. Heuristics only need to keep track of IPsec SAs.

Usually single IPsec SA has multiple TCP/UDP flows inside, so the
problem of keeping track IPsec flows is easier than keeping track of
TCP/UDP flows.

As this problem of keeping track of TCP/UDP flows has already been
solved by multiple vendors, in multiple products, I do not think we
need to start writing text about the cache management or algorithms.
This problem is not specific to the ESP-NULL heuristics, it is generic
flow management problem, which have been solved before.

> for DoS attacks as explained in the above post in the Security

What DoS attack you are talking. If you can provide me some text I can
put to draft, I am happy to do so, but anyways I would first need to
know which DoS attack you are talking about.
-- 
[email-masked]

---

From: Jack Kohn <[email-masked]>
Date: Sun, 31 Jan 2010 23:25:22 +0530

> know which DoS attack you are talking about.

I think there is some text wrt "cache trashing" which will require
re-execution of the heuristics engine. An attack exploiting this can
result in a DoS attack.

Jack