Subject: RE: draft-rajahalme-ipv6-flow-label-00.txt

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 19 Dec 2001 16:33:16 +0100

> AH: It could be possible to change AH, but it might not be 
  > worth it. The
  > main problem would be the interoperability problem between 
  > a source sending
  > non-zero flow label and including it in the AH computation, 
  > and an old
  > destination receiving it and replacing 0's for the Flow 
  > Label for AH check
  > (which would fail). But is this important? Could we just 
  > ignore AH? (Who is
  > using it anyway?)
  > 

=> I don't think we need to change AH. Even if we change 
AH, does that mean we would have to use it in every packet
just because we want to use the flow label ? I don't 
think that's a good idea. 
I think there are some cases where we would want the receiver
to reflect the flow label value, and for this case
we might want to make sure that the value is correct. 

I had a preliminary idea and was going to write something
about it. Basically the sender can generate the flow label
based on a hash of the source and destination port numbers. 
This is straight forward enough. If we want to make it 
more sophisticated then we can add another number 
to the hash input (e.g P1 || P2 || x).
Where x can be something specific to this flow. But
I think P1 and P2 are enough. 

Comments ?

Hesham

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Thu, 20 Dec 2001 10:18:20 +0100

In your previous mail you wrote:

=> this kind of things was already proposed... The main
objection is this reveals too much of the higher layer
and can conflict with the purpose of ESP (when ESP is used),
i.e. this can become a security threat.

   If we want to make it 
   more sophisticated then we can add another number 
   to the hash input (e.g P1 || P2 || x).
   Where x can be something specific to this flow.

=> so why not just x (:-)...

Regards

[email-masked]