Subject: [rohc] RE: (in)security of ESP with header compression

From: "Lars-Erik Jonsson (EAB)" <[email-masked]>
Date: Thu, 17 Apr 2003 10:56:12 +0200

> > The ROHC WG just has not yet addressed this issue, but we would
> > appreciate input on the subject, especially motivations for us
> > to look at it.
> 
> And this thread isn't sufficient motivation?  Summerizing the thread,
> it would be useful to use ROHC to compress ESP tunnels, but that
> implies the potential for out-of-order reception.

Neither "it can be done" nor "I want it to be done" are really actual
arguments for doing anything. However, there are usually real arguments
behind the latter, and those would be useful to hear.

Further, we need people to look at it to figure out what should be
done to address the problem identified (there might be several 
potential ways to address an issue), and then we need people to do
the actual work of writing documents.

I personally think it will be useful to have "ROHC over tunnels" 
clarified/defined, but as a WG chair I need some concrete needs,
as well as working resources (people interested in contributing).

Drafts are welcome!

BR
/Lars-Erik
_______________________________________________
Rohc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rohc

---

From: "Lars-Erik Jonsson (EAB)" <[email-masked]>
Date: Fri, 18 Apr 2003 10:26:43 +0200

Yes, I just assumed that such a "tunnel sequence number" would
be incrementally set. Otherwise it would not be useable for
detecting out-of-order packets.

/L-E

> I believe that the compressor also needs to be involved, 
> as reordering can only be detected by the decompressor
> if the compressor ensures that the sequence numbers it
> sends out are ordered.
> 
> Is there still an equivalent to the IPv4 protocol or IPv6
> Next Header field in the new ESP header?
>
> 
> > This is the approach we have previously discussed in ROHC
> > (just informally), and most tunneling protocols seem to have
> > a similar sequence number. The solution would then just be
> > a modified decompressor, making use of the tunnel sequence
> > number.
> > 
> > But still, someone should look more carefully at this, and
> > write something.