Subject: [seamoby] security disabling in CT reqs

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 10 Oct 2001 16:12:59 -0500

I have one quick comment for now:

I understand the thought behind the following section (some
folks don't care about security in their internal networks)

5.3.3 The protocol MUST provide for the security provisioning to be
      disabled.

However, reading in the ESP RFC, I found out that you cannot
NULL both authentication and encryption at the same time.

this means that ESP cannot be proposed for securing CT messages.
Since, I cannot disable both encryption and authentication at
the same time, so I cannot meet 5.3.3.

Does this mean, ESP is out of question for CT?
Any idea?

Regards,
Madjid

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 10 Oct 2001 17:24:54 -0700

> Does this mean, ESP is out of question for CT?

No. it just means that if the ESP header is present, both 
authentication and encryption cannot be sent to NULL at the
same time. atleast one should be used. of course the ESP
header itself can be absent. basically this is CT without 
security (req 5.3.3).

Vijay