Subject: [rohc] Updates to the RoHCoIPsec Internet-Drafts

From: "Ertekin, Emre [USA]" <[email-masked]>
Date: Mon, 7 Jan 2008 23:49:24 -0500

Hi All,

We have released new revisions to the RoHCoIPsec internet-drafts.  The
updated specifications are detailed in: 
* draft-ietf-rohc-hcoipsec-07
* draft-ietf-rohc-ikev2-extensions-hcoipsec-05
* draft-ietf-rohc-ipsec-extensions-hcoipsec-01

The primary change to the internet-drafts addresses a concern that was
raised several months ago regarding the possibility that packet headers
may be invalidly decompressed by the RoHC process, and forwarded into
the plaintext domain.  This scenario may occur when there is significant
packet reordering/loss between the compressor and decompressor.
Specifically, we are trying to address concerns noted in the following
sections of RFC 4224:

--Section 5.2.4: "Undetected Decompression Failures (R-Mode only)"
--Section 5.1.3: "The risk of forwarding incorrectly decompressed
packets to upper layers is therefore small when operating in U/O-mode."

The RFC indicates that when RoHC is operating in any mode (U/O/R), there
is at least a "small" probability for undetected decompression failures.
When operating within the context of IP security, this "small"
probability is not acceptable.  

To mitigate this concern, we have augmented the RoHCoIPsec processing
model to allow the use of an additional Integrity Algorithm (independent
of the one used by IPsec) to ensure that packet headers are properly
decompressed.  More specifically, the compressor will generate an
Integrity Check Value (ICV) on the uncompressed packet, and will
transmit the ICV with the RoHC-compressed packet.  At the decompressor,
after the packet is decompressed, an ICV is calculated and compared to
the ICV calculated at the sender.  If the ICVs match, packet headers
have been validly decompressed.  If the ICVs do not match, decompression
failure has occurred, and therefore the packet is dropped. 

Obviously, we are reducing compression efficiency when we transmit
additional ICV with compressed packets; however, the additional
integrity-check ensures that all packet headers are validly decompressed
before being forwarded into the PT domain.  

Note that we negotiate the specifics of the Integrity Algorithm in the
IKEv2 Notify payload.

As always, comments/suggestions are welcome on all three
internet-drafts!

Best Regards,
Emre

_______________________________________________
Rohc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rohc