Subject: Re: Draft on Advice for Internet Subnetwork Designers

From: Joe Touch <[email-masked]>
Date: Wed, 1 Mar 2000 11:11:54 -0800 (PST)

> From [email-masked]  Wed Mar  1 10:46:34 2000
> Date: Wed, 1 Mar 2000 18:46:28 +0000 (GMT)
> From: Lloyd Wood <[email-masked]>
> To: Joe Touch <[email-masked]>
> cc: [email-masked], [email-masked]
> Subject: Re: Draft on Advice for Internet Subnetwork Designers
> X-no-archive: yes
> 
> On Wed, 1 Mar 2000, Joe Touch wrote:
> > Gorry wrote:
> > > Joe Touch wrote:
> > > > Gorry wrote:
> > > > > IPv6 does
> > > > > not therefore implement a network level integrity checksum. The role of the
> > > > > IP checksum has therefore been subsumed into the TCP and UDP
> > > > > checksums.
> > > >
> > > > More into IPSEC than into TCP and UDP, no?
> 
> No.
> 
> > > IPSEC is one way, it is not (I think) mandatory, so TCP/UDP may still get
> > > bad packets which they have to reject....
> 
> Yes. Of course, since the TCP/UDP checksum is weak, there's a chance
> that a bad packet may slip through.
> 
> 
...
> > The role of the IP checksum was to check the IP header. The role of
> > the TCP/UDP checksums is to check the data.
> 
> Sorry, no. The TCP/UDP checksums still check the integrity of
> significant parts of the IP header, even with IPv6. Remember the
> "pseudo-header"?

It certainly checks the pseudo header. Not the header.
There are components of the header not in the pseudoheader
(flags, options, etc.)

> > If you want to protect/sum
> > the header, you should (and thus, above, can) use IPSEC.
> 
> Sorry, no. Use of IPSec is not necessary. Useful header integrity
> checks come with the standard UDP/TCP pseudo-header check in IPv6, and
> including pseudo-headers in checksums is an expected feature of any
> IPv6 transport protocol.

Not if you are concerned about the integrity of the IP header -
all (or at least the end-to-end part, including flags and E2E options)
of it.

Joe

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 1 Mar 2000 19:48:57 +0000 (GMT)

> all (or at least the end-to-end part, including flags and E2E options)

If you're using AH or ESP in tunnel mode, you'll get all the IP
header. Otherwise, yes, AH in transport mode gives a check on
everything bar mutable fields, while ESP is useless in this regard.

Header checksumming isn't an intended explicit design feature of
IPSec, surely? More a side-effect of authentication...

[http://www.counterpane.com/ipsec.html questions header verification,
AH and transport mode entirely, and points out problems with AH header
authentication.]

Doesn't the complexity for IPSec-based header protection more than
outweigh the incremental value of any gains over the pseudo-header
check?

L.

I'm pretty sure that header checksumming is _not_ what IPSec is _for_.
What is IPSec for?

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>