Subject: Fwd: IPsec issue #46 -- No need for nested SAs or SA bundles

From: Karen Seo <[email-masked]>
Date: Tue, 2 Sep 2003 18:43:33 -0400

>X-Sender: [email-masked]
>Date: Wed, 27 Aug 2003 11:10:02 -0400
>To: [email-masked]
>From: Karen Seo <[email-masked]>
>Subject: IPsec issue #46 -- No need for nested SAs or SA bundles
>Cc: "Angelos D. Keromytis" <[email-masked]>, [email-masked],
>    [email-masked]
>X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang)
>Status:  
>
>Folks,
>
>Here's a description and proposed approach for:
>
>IPsec Issue #:	46
>
>Title:		No need for nested SAs or SA bundles
>
>Description:	There is no mandate to support nested SAs or SA bundles.
>		It would be easy to include support for the simple
>		AH+ESP combination that IKEv1 was able to negotiate, and
>		that 2401 mandates, if that combination is still viewed
>		as needed. However, IKEv1 was not able to negotiate any
>		other nested protocol combinations and IKEv2 does not
>		support negotiation of SA bundles.
>
>Proposed approach:
>
>      1. There will be no support for nesting or SA bundles except via
>	iteration through IPsec processing.  Add text to the discussion
>	of differences between 2401 and 2401bis, along the lines of:
>
>	"The requirement to support nesting of SAs and the concept of
>	SA bundles has been removed. An SPD entry specifies application
>	or removal of only one IPsec header. An implementation MAY
>	choose to offer SA nesting via appropriate configuration of
>	SPDs and forwarding tables. After the packet has passed through
>	IPsec processing, it can be redirected through the IPsec module
>	again via local, ipsec-virtual-interfaces and use of the [still
>	under discussion] forwarding lookup function, to cause more
>	than one layer of IPsec headers to be applied or removed. Note
>	that to accomplish this, multiple entries would have to be
>	created, in distinct SPDs, each specifying a layer of IPsec
>	processing to be applied.  There is no IKE support for
>	negotiating nested SAs, which implies that manual configuration
>	or use of additional policy management protocols would be
>	required to coordinate processing at peer IPsec implementations."
>
>Thank you,
>Karen

---

From: Michael Richardson <[email-masked]>
Date: Tue, 02 Sep 2003 20:47:10 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Karen" == Karen Seo <[email-masked]> writes:

  This is way too specific.
  It can be looped would be sufficient comment.

    >> than one layer of IPsec headers to be applied or removed. Note

  removed is seldom a problem really, except that if you don't do it
all within the IPsec module, you may not be able to determine that an
ESP packet did in fact come within another ESP packet.

]      Out and about in Ottawa.    hmmm... beer.                |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [