Subject: RE: [rohc] RE: (in)security of ESP with header compression

From: "Lars-Erik Jonsson (EAB)" <[email-masked]>
Date: Fri, 18 Apr 2003 09:34:18 +0200

Yaron,

> ESP includes a 32-bit sequence number. It is mandatory for 
> the sender to set and increment it correctly, but optional
> for the receiver to verify it. It is there to prevent
> malicious replay of messages.
>
> Under these assumptions, I don't believe any change to the
> operating assumptions of ROHC, or a new ROHC profile, is
> needed. This is not "ROHC over tunnels" but only "ROHC over
> ESP", but it's still an interesting case.

This is the approach we have previously discussed in ROHC
(just informally), and most tunneling protocols seem to have
a similar sequence number. The solution would then just be
a modified decompressor, making use of the tunnel sequence
number.

But still, someone should look more carefully at this, and
write something.

Rgds,
/L-E
_______________________________________________
Rohc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rohc

---

From: "Mikael Degermark" <[email-masked]>
Date: Fri, 18 Apr 2003 01:08:01 -0700

I believe that the compressor also needs to be involved, 
as reordering can only be detected by the decompressor
if the compressor ensures that the sequence numbers it
sends out are ordered.

Is there still an equivalent to the IPv4 protocol or IPv6
Next Header field in the new ESP header?

Micke