In your previous mail you wrote:
T= 0.5 seems fairly high. Why not .1 or .01 (on today's links).
=> I agree because T should be in milliseconds (f.1) and
is against back-to-back erroneous packets. I propose 20ms (50Hz).
So, question for the WG: Is the current text on this topic adequate,
or should it be revised?
=> it should be improved!
It doesn't seem to note that ESP can do authentication only
now. Should ESP (w/o encryption) also be used if an SA exists?
1. ICMP messages may be subject to actions intended to cause the
receiver to believe the message came from a different source than
the message originator. The protection against this attack can be
achieved by applying the IPv6 Authentication mechanism [IPv6-AUTH]
to the ICMP message.
=> ESP cannot do authentication of the IPv6 header in transport mode,
I vote to leave the text (with "can be achieved..." which is only
an example).
How does one know that a particular SA is authorized to speak on
behalf of a particular IP address (or actually came from the message
originator)?
=> because of the authentication part of any SA establishment protocol.
Note, this issue is one of the reasons why IPsec doesn't
automatically solve the problem of authenticating MIPv6 BUs.
=> no, the problem with MIPv6 is the authentication phase can (must
in some cases) be done using a care-of address and the natural link
between addresses and identies must be reported into the policy.
There is no reason to do the same thing in the general case, i.e.
default policies shall reject such strange things (there was some
messages in the IPsec list about this).
2. ICMP messages may be subject to actions intended to cause the
message or the reply to it go to a destination different than the
message originator's intention. The ICMP checksum calculation
provides a protection mechanism against changes by a malicious
interceptor in the destination and source address of the IP packet
carrying that message, provided the ICMP checksum field is
protected against change by authentication [IPv6-AUTH] or
encryption [IPv6-ESP] of the ICMP message.
seems like if you have AH/ESP, that check alone provides you the
additional protection. That it also covers the ICMP checksum is not
really relevant...
=> I agree the wording can be improved but where is the proposal for
a new wording?
needs an IANA Considerations Section.
...
=> agree (we have to get better habits :-)
Regards
[EMAIL PROTECTED]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page: http://playground.sun.com/ipng
FTP archive: ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [EMAIL PROTECTED]
--------------------------------------------------------------------
