Subject: [Hipsec] RE: ESP draft snapshot 31.05.05

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Tue, 31 May 2005 09:21:59 -0700

Petri,
please see below...

> "These mechanisms can be considered to be on the network side 
> of IPsec, 
> thus they cannot add any integrity or conficentiality 
> problems that would 
> not exist without them."
> 
> Is this any better?

Yes, this is better.

> > - The 64-bit sequence number is interesting, but: To 
> implement it, you 
> > just keep an additional 32-bit counter representing the 
> upper bits? Upon 
> > rollover of the lower 32-bits, you increment the upper. What is the 
> > usefulness of this? i.e. how can the replay window be 
> enforced if it is 
> > not part of each packet? Maybe we could have more text on 
> this or an 
> > appropriate reference.
> 
> Hmm.. I'm not sure how to fix this. Earlier there was some talk about 
> having AES-CBC IV vectors from the sequence number, but the 
> RFC3602 states 
> that the IV must be random.

So is there a benefit to using these 64-bit sequence numbers? Why do we
need them?

> > - the key index field of the ESP_INFO parameter is 
> mentioned for the 
> > rekeying section, but not in the preceding section when 
> discussing the 
> > ESP_INFO.
> 
> I couldn't now find the place in text. Can you give a pointer to that?

(using pre310505)
Section 4.1.2 Updating an Existing ESP SA  -- this mentions the keymat
index.
Section 4.1.1 Setting up an ESP Security Association -- this contains no
mention of the keymat index.
The keymat index is described in detail in 5.1.1 ESP_INFO, then for
packet processing, it is described for sections 6.8, 6.9, 6.9.1, 6.9.2,
6.9.3, 6.10,  but not in sections 6.5 and 6.6.

Section 7 Keying Material says "After the HIP association keys have been
drawn, the ESP keys are drawn..." and this is the first advice given to
the reader on what value the keymat index should have during the base
exchange.

The other various revisions noted in this email look good.

-Jeff

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec