[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[anonsec] 3401 and highjacking




Stephen Kent wrote:
...
>>>>  I *fully* agree with the fact that TCP/MD5 doesn't offer the same
>>>>  protection as IPsec, but it does protect the transport layer. That
>>>>  differentiates it from TLS.
>>>
>>>  it offers some protection, but to say that it "protects" the layer
>>> might
>>>  surprise folks who think confidentiality is important :-).
>>
>> The same is true for an IPsec SA based on MD5. The point wasn't privacy
>> vs. authentication; it's transport vs. non-transport.
> 
> First, there are no SAs that are protected via MD5, per se, although we
> can have SAs that make use of HMAC-MD5.

I never knew that HMAC-MD5 was not based on MD5. ;-)

> But, ESP (which is a more
> efficient way to offer integrity and authentication that AH), also
> offers confidentiality, if desired. Thus it can "protect" a connection
> to whatever extent a user wishes, depending on selection of appropriate
> options, unlike the limited forms of protection offered by the TCP-MD5
> checksum option.

I never knew there was a way to use ESP with an algorithm based on MD5
(e.g., HMAC-MD5-96, as per RFC4305) that afforded confidentiality either.

Joe



> 
> Steve


Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.