[core] DTLS and Epochs

[Jim Schaad <[e-mail]>]

I am working on getting my DTLS code to work correctly and I have come
across something that I do not understand.  I did not see any messages in
the mailing list that dealt with this so I would like to get an explanation
if possible.

RFC 7252 states that a response is not to be correlated with a request
unless the message id, the DTLS session and the DTLS epoch are the same.  I
can understand the reasoning behind the id and session being the same,
however I am unsure of the reason that the epoch would need to be the same
as well.  I cannot see of a reason why the epoch should matter.  The
security session is still the same.  I could understand that there would be
a reason to kill an association if additional client or server
authentication information had been passed along, but while that would
change the epoch, an epoch can change just because enough messages have been
sent over the pipe.

Can somebody please explain the reasoning to me.

Jim