Re: ESP NULL was linux-ipsec: broken for a few days...

rob.glenn@nist.gov writes:
> ESP-NULL was initially requested by a particular vendor which wanted to
> use IPsec authentication services on non-IP networks and had other
> proposed uses for an authentication algorithm that ignores the IP header.
[...]
> time, equally as strong as AH with <same algorithm>, it was decided to
> make ESP_NULL a "mandatory to implement" algorithm (as specified in the
> DOI draft). I seriously doubt this will change.
This is a poor state of affairs. A single, yet unnamed, vendor managing to add something as MANDATORY to the drafts with a reasoning not even IP related.

AFAIK NAT has been given as the only 'sensible' reason for 'null esp' so far.

I wish it were that easy to make clearly necessary transforms like 3DES mandatory.

BTW the book by Diffie and Landau, "Privacy on the Line", is a nice reality check.

Greetings,
 Niels

-- 
- PHYSnet Rechnerverbund     PGP V2.6 Public key via finger or key server
  Niels Provos               
  Universitaet Hamburg       WWW: 
http://www.physnet.uni-hamburg.de/provos/   
  Jungiusstrasse 9           E-Mail: provos@wserver.physnet.uni-hamburg.de
  Germany 20355 Hamburg      Tel.:   +49 40 4123-2404     Fax: -6571