Re: replay field size

[[e-mail]]

At 12:01 PM 2/12/97 -0500, John Keating wrote:
>> Should AH and ESP both have a fixed size replay counter ? (Yes/No/Don't
>Care)
>
>I would tend to look towards the future, and ask for negotiation. ("640K
>is more than anyone would ever need!") Why hardwire something that may
>need to be changed at some future date? Perhaps default to a minimum
>value, but don't lock it in.

Agree.

I don't see why ESP need the replay counter? The IV along with ESP header
is also functioning as a replay preventor. 

For AH, however, it should have the replay counter. There should be a flag
field in the AH header to indicate if the parket include the replay or not
and other values in the future. I think the reserve field are wasted. It
should be removed and used as the flag (16 bits) in stead. In this way, one
can flexibly add/change any fields in the future or live along with
variable AH.

I strongly disagree any FIXED agreement without flexibility fields.

>
>> If they have a fixed size counter, what size should it be? (32 bits/64
bits)
>
>See above, and default to 32 bits.
>
>> Should SHA-1 output be truncated to 128 bits from 160 bits ? (Yes/No/Don't
>Care)

With the AH flag, one can use whatever they like.

>
>I tend to lean towards leaving it at 160 bits. As some have mentioned,
>it was designed at that, why weaken it by truncating it?

Same as above.

Wei Xu
Trusted Information Systems, Inc