Subject: [rohc] ROHC over tunnels with security

From: Samphel Norden <[email-masked]>
Date: Fri, 03 Oct 2003 15:34:45 -0400

Hi All,
    This is regarding a topic that may have been discussed earlier.
Basically, I want to know if there is any on-going work that seeks to
adapt ROHC to be used over IPSec. Since an IPSec tunnel can be
considered as a virtual link, it is possible to consider using ROHC over
it.

However, there are problems using ROHC with IPSec, namely the inability
to compress the AH+ESP headers since compression of the inner header is
done before encryption.Another problem being the reordering that is not
tolerated by ROHC but is a possible by-product of using a tunnel. There
are a few other combinations apart from ROHC over IPSec:

- IPComp over IPSec
- SRTP with ROHC (specifically for Voice-over-IP)

To summarize, there seem to be the following issues:
1. Performance if ROHC is used over IPSec (due to header expansion)
2. Reordering if ROHC is used over tunnels (can also lead to potential
DoS attacks if malicious intermediate routers drop or delay packets to
cause reordering).
3. Also, is there any relevant benefit of using either of the
aforementioned alternative combinations (IPComp, SRTP) in practice?

I wanted to know if these issues have been looked at in a draft(s) and
whether they matter at all in current implementations?

-Samphel