Re: ipsec questions/bugs/fixes (PF_KEY/PF_ENCAP)

[Craig Metz <cmetz@inner.net>]

In message <199903021704.KAA01661@openbsd.cs.colorado.edu>, you write:
>You forgot to specify the IV for the transforms. PF_ENCAP was
>able to do IV-less mode by deriving an IV from the packet headers.
>We dont do that any more with PFKEYv2.

  This can be expressed in PF_KEYv2 with an IV length of zero. Though deriving
an IV from anything else in the packet is probably not a good idea from a
crypto point of view.

									-Craig