Re: proxy AH (was: An architectural draft)

[Iljitsch van Beijnum <iljitsch@muada.com>]

On donderdag, mei 29, 2003, at 00:59 Europe/Amsterdam, Eliot Lear wrote:

> When you say proxy AH do you mean the ISP actually creating the AH or 
> just discarding invalid/bad AHs?
The idea is that the customer gives to its correspondents a key to be 
used in calculating the authentication header. This key is derived from 
one of a small set of possible "master keys" combined with the 
correspondents source address. The master keys are communicated to the 
ISP (for instance by inserting them in a BGP attribute) so the ISP can 
calculate the key used for a packet and then check the authentication 
header. Then packets that don't have an AH or for which the AH check 
fails are severely rate limited while packets that pass the check can 
flow freely. When a key is abused the master keys are rotated and the 
abuser simply doesn't get a new key.

This requires some serious hardware at the ISP side but it should get 
rid of DoS real good. The main problem is allowing control traffic in 
order to distribute the keys to the correspondents. Depending on 
whether we can/want to use unmodified IKE or not this should either be 
backward compatible or easy to fix, but probably not both.