Re: [babel] Solving HMAC replay once and for all

[Markus Stenberg <[e-mail]>]

On 28 Jun 2018, at 12.44, Juliusz Chroboczek <[e-mail]> wrote:
>> (I think it just leads to some ‘packet loss’ if we get stuff outside
>> replay window, so it is fine; the challenge-response should be probably
>> triggered if and only if no valid stuff has been received for X from the
>> node..)
> Challenge on nonce change only, not on out-of-order PC?

I think there is a tradeoff between DoS resistance (no spurious challenges) and fast recovery from sender state loss. There seems to be plenty of design decisions to be made here though, and only based on them sensible choices can be made, but for the time being I am leaning towards the former, so I’d say challenge should be sent iff:

- no sender nonce for node (duh; new node), _or_
- no valid hmac (with valid sender nonce) received over time period of (IHU interval * something)

The messages with counter outside replay window (if used at all) would be just ignored if replay window is not used. 

e.g. sender reboots -> with this scheme, it would only recover with timeout and that’s bit icky as well.. on the other hand, node reboots probably take normally some time as well so I am not sure it is really as bad as one could think on first estimation. Key rotation or intentional counter reset/roll-over might need further thought though..

-Markus