Subject: Re: [OPSEC] Erik Kline's No Objection on draft-ietf-opsec-ipv6-eh-filtering-08: (with COMMENT)

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 7 Jul 2021 19:00:20 -0700

On Wed, Jun 30, 2021 at 10:03:48PM -0700, Erik Kline via Datatracker wrote:
> [S4.3.9.4] [comment]
> 
> * It seems fairly clear from RFC 5570 Security Considerations that a
>   CALIPSO option is best protected with an AH, and in such cases stripping
>   the CALIPSO option would cause the packet to fail validation at the
>   (suitably configured) destination.
> 
>   Similarly, it might be good to note in S4.3.9.5 that if an AH is present
>   presumably the advice from S3.4.5.5 applies.

Probably not very relevant here, but the current IPSECME advice is to use
ESP with null encryption rather than AH.

-Ben

---

From: Fernando Gont <[email-masked]>
Date: Thu, 8 Jul 2021 03:48:05 +0000

Hello, Ben,

> ESP with null encryption rather than AH.

A pointer might be worth including. What document and section should we
be referencing here?

Thanks!

Regards,
-- 
Fernando Gont
Director of Information Security
EdgeUno, Inc.
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531

---

From: Erik Kline <[email-masked]>
Date: Wed, 7 Jul 2021 21:00:33 -0700

> ESP with null encryption rather than AH.

My (mis)understanding was that this was mostly because of NAT/NAPT.  Is
there some benefit of this recommendation that applies when NAT/NAPT
doesn't apply (/me looks at IPv6).

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 15 Jul 2021 13:03:56 -0700

Hi Fernando,

> A pointer might be worth including. What document and section should we

It's not perfect, but
https://datatracker.ietf.org/doc/html/rfc8221#section-5 does include:

   ENCR_NULL status was set to MUST in [RFC7321] and remains a MUST to
   enable the use of ESP with only authentication, which is preferred
   over AH due to NAT traversal.  ENCR_NULL is expected to remain MUST
   by protocol requirements.

-Ben