Subject: RE: [seamoby] security disabling in CT reqs

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 11 Oct 2001 14:38:13 -0500

Thanks Vijay, I came to the same conclusion since
sending the email. The ESP header can be absent, if you
don't want security.

Madjid

-----Original Message-----
From: Vijay Devarapalli [mailto:[email-masked]]
Sent: Wednesday, October 10, 2001 7:25 PM
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]
Subject: Re: [seamoby] security disabling in CT reqs

Nakhjiri Madjid-MNAKHJI1 wrote:
> 
> I have one quick comment for now:
> 
> I understand the thought behind the following section (some
> folks don't care about security in their internal networks)
> 
> 5.3.3 The protocol MUST provide for the security provisioning to be
>       disabled.
> 
> However, reading in the ESP RFC, I found out that you cannot
> NULL both authentication and encryption at the same time.
> 
> this means that ESP cannot be proposed for securing CT messages.
> Since, I cannot disable both encryption and authentication at
> the same time, so I cannot meet 5.3.3.
> 
> Does this mean, ESP is out of question for CT?
> Any idea?
> 

No. it just means that if the ESP header is present, both 
authentication and encryption cannot be sent to NULL at the
same time. atleast one should be used. of course the ESP
header itself can be absent. basically this is CT without 
security (req 5.3.3).

Vijay