Search RFCs

RFC Editor

File formats:

Status:

PROPOSED STANDARD

Authors:

K. Grewal
G. Montenegro
M. Bhatia

Stream:

IETF

Source:

ipsecme (sec)

Cite this RFC:TXT  | XML  |  BibTeX

DOI:  https://doi.org/10.17487/RFC5840

Discuss this RFC: Send questions or comments to the mailing listipsec@ietf.org

Other actions:Submit Errata  | Find IPR Disclosures from the IETF  | View History of RFC 5840

Abstract

This document describes the Wrapped Encapsulating SecurityPayload (WESP) protocol, which builds on the EncapsulatingSecurity Payload (ESP) RFC 4303 and is designed to allowintermediate devices to (1) ascertain if data confidentiality isbeing employed within ESP, and if not, (2) inspect the IPsecpackets for network monitoring and access control functions.Currently, in the IPsec ESP standard, there is no deterministicway to differentiate between encrypted and unencrypted payloadsby simply examining a packet. This poses certain challenges tothe intermediate devices that need to deep inspect the packetbefore making a decision on what should be done with that packet(Inspect and/or Allow/Drop). The mechanism described in thisdocument can be used to easily disambiguate integrity-only ESPfrom ESP-encrypted packets, without compromising on the securityprovided by ESP. [STANDARDS-TRACK]

For the definition ofStatus,seeRFC 2026.

For the definition ofStream, seeRFC 8729.