Re: WG next steps

[RJ Atkinson <rja@extremenetworks.com>]

On Friday, Nov 15, 2002, at 00:20 America/Montreal, Michael Richardson 
wrote:
>   If you do IPsec between every set of end-points, then you can easily 
> insert
> the appropriate End-point-identifiers for the transport layer.  
> Bellovin has
> pointed out that once you've authenticated the packet via IPsec, you 
> just
> don't care what's in the IP header. (This is often an argument why 
> against
> AH.)
There is an attack that Bellovin overlooks, so AH actually does matter.
(Caveat: This is controversial, because I *never* am first to discuss 
attacks
in public.)

Ran