Subject: Re: [MOBILE-IP] RFC 2401 section 5.2.1

From: Francis Dupont <[email-masked]>
Date: Fri, 24 Nov 2000 18:09:55 +0100

In your previous mail you wrote:

   On Wed, 22 Nov 2000 [email-masked] wrote:
   >    most of routing protocol needs to somehow protect IPv6 source address,
   >    as they will use (peers') IPv6 source address as the nexthop router
   >    information...

   Many of the death-to-AH enthusiasts also favoring killing transport mode

=> I know... but IMHO the tunnel mode is not very primitive, ie. this is
tunnel plus transport plus clarifications about inner/outer addresses.

   and doing everything with tunnel mode, in which case the inner headers --
   the ones that would be visible to applications -- are fully protected.
   (Notably, they can be encrypted as well as authenticated, if desired.)

=> VPN is not the only usage of IPsec and transport mode is better for
end-to-end security.

About the tunnel mode, for IPv6 there is an important implementation choice:
to use a policy or to use an interface (with link-local addresses,
neighbor discovery, ...).

Regards

[email-masked]

PS: there are many votes about AH in the past, AH is still alive
(we voted to keep it) and needed by many IPv6 protocols (cf Itojun's mail).

---

From: Henry Spencer <[email-masked]>
Date: Fri, 24 Nov 2000 12:34:48 -0500

> => VPN is not the only usage of IPsec and transport mode is better for

How is it "better"?  Aside from slightly reducing the byte count on the
wire, I mean?

We use tunnel mode for end-to-end security quite routinely.  In fact, it
seems to us that tunnel mode actually gives slightly higher security,
because it obscures whether the communication really *is* end-to-end or is
being done on behalf of other hosts.

> PS: there are many votes about AH in the past, AH is still alive...

So far, yes.

> ...and needed by many IPv6 protocols (cf Itojun's mail).

That is exactly the question:  *should* those protocols be relying on the
quirks of AH?  It would be better if they could also work with ESP.

                                                          Henry Spencer
                                                       [email-masked]