Subject: [IPsec] Add new protocols that require AH?

From: Jack Kohn <[email-masked]>
Date: Wed, 23 Nov 2011 04:54:52 +0530

As per RFC 4301 implementing AH is a MAY and ESP a MUST. Given that
most of what is achieved by AH can be easily achieved by ESP-NULL, is
there a possibility that AH may get deprecated in the future. Should
new protocols or mechanisms be defined in IETF that depend solely upon
AH to be supported?

Jack

---

From: Yoav Nir <[email-masked]>
Date: Wed, 23 Nov 2011 09:07:00 +0200

Hi Jack

> new protocols or mechanisms be defined in IETF that depend solely upon

Hard for us to predict what future RFCs might do. There is no particular security problem with using AH. It lives up to its security claims, so I doubt a future RFC will actually deprecate it. 

Having said that, there may be a future RFC moving AH (RFC 4302) to historic. Moving AH to historic doesn't mean that you should stop using AH right now. It only means that in the opinion of the community there are now better alternatives. Even if such a document is adopted, it does not mean you can't bring new work to the IETF that will require or enhance AH. It just means that you will probably need to do a lot of explaining about why that is really needed. A section entitled "Why ESP-NULL is not a good option here" would do.

Yoav

---

From: Stephen Kent <[email-masked]>
Date: Mon, 28 Nov 2011 09:37:03 -0500

>new protocols or mechanisms be defined in IETF that depend solely upon

I concur with your observations. I recommend against new (or revised) protocols
mandating use of AH.  ESP NULL makes more sense in evey case that I have seen.

Steve