RE: header and data digest issue

[Paul Koning <ni1d@arrl.net>]

>>>>> "Julian" == Julian Satran <Julian_Satran@il.ibm.com> writes:

 Julian> David, Usually (not always) middleboxes terminate TCP
 Julian> connections. That is the reason some of us wanted a separate
 Julian> CRC on the data - even with IPsec. The scenario suggested is
 Julian> not the only way in which middleboxes may mess up things.  An
 Julian> incrementaly recomputed CRC may solve this type of failure
 Julian> but who says that the middle box will play by the rules and
 Julian> not mess-up with the data in unexpected ways?  I think that
 Julian> we have a decent solution for SCSI data integrity that is
 Julian> both simple and robust with respect to accidental failures.

Agreed.

For any integrity mechanism, you can postulate an implementation
sufficiently broken that it defeats the mechanism.  That isn't the
point of the CRC, or the TCP checksum, or other mechanisms.  All those
mechanisms are there to deal with bit errors caused by noise, and
things of that sort.

       paul