From owner-freebsd-security@FreeBSD.ORG Fri Apr 23 05:02:17 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8BA1816A4CE for ; Fri, 23 Apr 2004 05:02:17 -0700 (PDT) Received: from fnord.ir.bbn.com (fnord.ir.bbn.com [192.1.100.210]) by mx1.FreeBSD.org (Postfix) with ESMTP id D1C9743D1F for ; Fri, 23 Apr 2004 05:02:16 -0700 (PDT) (envelope-from gdt@ir.bbn.com) Received: by fnord.ir.bbn.com (Postfix, from userid 10853) id E5FE61F69; Fri, 23 Apr 2004 08:02:15 -0400 (EDT) To: "Dan Langille" References: <40885ECF.22456.1C68F42E@localhost> From: Greg Troxel Date: 23 Apr 2004 08:02:15 -0400 In-Reply-To: <40885ECF.22456.1C68F42E@localhost> Message-ID: Lines: 12 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii cc: freebsd-security@FreeBSD.org Subject: Re: IPsec - got ESP going, but not AH X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Apr 2004 12:02:17 -0000 While this should probably work, it's more straightforward to use ESP with integrity protection. That is, use a -A hmac-sha1 argument also to ESP. (hmac-md5 is probably still fine, but sha1 goes better strength-wise with rijndael-cbc.) I believe that in tunnel mode AH and ESP integrity are essentially identical - but read RFC2401 and rfc2401bis (i-d from ipsec wg) if you really want to understand. In transport mode, AH protects parts of the original (and only) IP header. -- Greg Troxel