Subject: Re: Flow Label

From: Scott Bradner <[email-masked]>
Date: Wed, 26 Dec 2001 13:16:21 -0500 (EST)

> The most compelling application I've seen is
> for QoS classification when the packet
> is encrypted.

the difserv field is not encrypted so I am not compelled by this example

Scott
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Wed, 26 Dec 2001 10:33:03 -0800

Scott,

> the difserv field is not encrypted so I am not compelled by this
example

If by this you mean that the flow label is not covered
by AH then I agree that this is a weakness in the flow label proposal.
The end node cannot check that the flow label wasn't changed
in transit. To really allow authentiated QoS, it
would need to be included in packet authentication.

As for the traffic class field, I think it might be difficult to
include it into any encryption or authentication calculation
in any case, because, as I understand its definition, it was defined
to be mutable to allow different networks to apply
different kinds of diffserv classifications.

            jak

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 27 Dec 2001 13:16:16 +0100

The diffserv field is mutable. The argument for an immutable
field applies to both intserv and diffserv. It's actually more compelling
than just the encryption case, for diffserv: it allows us to carry
semantics that are not conveyed by the port #s and protocol type.

   Brian