Subject: [Isis-wg] Re: Deprecation of AH header from the IPSEC tool kit

From: Radia Perlman <[email-masked]>
Date: Thu, 15 Jun 2000 22:32:53 -0700 (PDT)

Ran said:

>>	         A counter-example is the Source Routing header, which can
>>	be authenticated hop-by-hop with AH ...

How do you authenticate something hop-by-hop when the key is only
known end-to-end? Are you maybe assuming hop-by-hop IPSec tunnels between the
routers listed in the source route header?

Radia

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Radia Perlman - Boston Center for Networking <[email-masked]>
Date: Mon, 19 Jun 2000 19:26:38 -0400 (EDT)

Ran, another basic question...

What's the threat solved by authenticating the source route header
at intermediate points? What would be the problem if a packet
showed up at the destination, not having traversed the route
you wanted? I'm assuming you're not trying to solve the confidentiality
problem by making sure that the packet stays in "friendly" parts of the
net, and therefore doesn't need encryption, but if it took a different
route it would need encryption.

Radia