Please explain are there any reason under the hood to place "Next Header" field in ESP trailer instead of ESP Header ?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Well, in IPsec transport mode, the 'Next Header' gives the protocol type of the encrypted packet (e.g. TCP, UDP, etc), and hence is considered confidential, as we don't want the adversary to know the type of traffic. The ESP Header is not encrypted, and hence we cannot put the 'Next Header' field there.
In AH, privacy is not a concern (everything is visible), and hence they do put the 'Next Header' field in the AH header.
-
$\begingroup$ Yes understandable, but very inconvenient for cut-through processing of received datagram, because packet classification can start only after completion of decryption& authentication and not in parallel $\endgroup$ Commented Mar 27, 2018 at 7:27
-
$\begingroup$ @ElenaGurevich: actually, if you are doing tunnel mode, then it's a lot simpler; the packet is to be forwarded only if the next header is a specific value (4 for IPv4, 41 for IPv6, you can determine which it is from the first nybble of the decrypted IP header); hence you can do parallel packet classification assuming it's an IP packet, and cancel it if the decrypted next header is not the expected value (or on authentication failure or decryption failure). On the other hand, doing processing on partially decrypted data can give the attacker an oracle; you need to be careful $\endgroup$– ponchoCommented Mar 27, 2018 at 13:41