Re: simplifying rekeying [draft-jenkins-ipsec-rekeying-06.txt]

["Valery Smyslov" <[e-mail]>]

----- Original Message -----
From: Bill Sommerfeld <[e-mail]>
To: Valery Smyslov <[e-mail]>
Cc: <[e-mail]>; <[e-mail]>; Dan Harkins <[e-mail]>; Henry
Spencer <[e-mail]>; IPsec List <[e-mail]>; Hugh Daniel <[e-mail]>;
John Gilmore <[e-mail]>
Sent: Monday, July 17, 2000 1:36 PM
Subject: Re: simplifying rekeying [draft-jenkins-ipsec-rekeying-06.txt]


> > Nothing prevents implementation from keeping last received packet
> > (or hash of it) in SA state and discarding any incoming packet if it
> > is identical to the packet kept. At least our implementation behaves
> > this way and we have never encountered your problem.
>
> You'll still get wind up with garbled decryptions of a retransmission
> if the network reorders packets on you..  i.e., if you recieve packet
> 1, then packet 2, then a duplicate/retransmission of packet 1.

OK, then keep all of them (or better hashes). I guess there will
be not too many of them, at most 3 :-)

> (maybe you've not played with flakeways and other similarly "abusive"
> test environments..)

We did. However test environments differ, so maybe we played
other scenarious then you.

> - Bill

Regards,
Valera.