WESP Extensions 76 IETF Nov 2009 IPsecme WG Meeting 12-Nov-2009 Gabriel Montenegro Ken Grewal

Motivation WESP enables extra capabilities for traffic visibility to IPsec At the same time: versioning and extensibility is now possible Some mailing list discussions have pointed out that this is almost as useful as the base capabilities Proposal: define the extensibility via options along the lines of IPv6 options 12-Nov IETF IPSECME WG2

Some potential applications Caveat: Just for illustration, main point is to request the WG to work on the extensibility capability for WESP Padding Option (the hello world of extensibility) Operations and Management –connectivity verification (in-band) –error notification –SA monitoring option Encryption offset To carry security labels in labeled IPsec? Main point: define the extensibility for any of the above and others 12-Nov IETF IPSECME WG3

4 WESP Extension (1) | WESP Header | | WESP Extension Payload | | ESP Encapsulation | ~ ~ | | Nov IETF IPSECME WG

5 WESP Extension (2) | Next Header | HdrLen | TrailerLen |V|V|E|P|X|Flags| | Type | Length | Data (variable) | | Data (variable) | ~ ~ | | | ESP Encapsulation | ~ ~ | | Type: per IPv6 (RFC2460) High order 2 bits specify behavior when the option is not recognized: 00 - silently skip the option 01 - silently discard the packet 10 - discard and send ICMP parameter error 11 - discard and send ICMP parameter error if not multicast Next bit specifies mutability of the option: 0 – immutable option (included in WESPs ICV) 1 - mutable option (NOT included in WESPs ICV) Length: in octets, excluding Type and Length fields 12-Nov IETF IPSECME WG

Other Considerations IKE negotiation similar to WESP: –notification USE_WESP_EXTENSIONS Flag versus new version number? –If new version number, we dont need another flag 12-Nov IETF IPSECME WG6