Re: [saag] [Cfrg] Re: TCP-AO MAC algorithms

[Joe Touch <[e-mail]>]

...
>> If there were no assumption, then I would agree, but the above indicates
>> a clear assumption that we cannot clearly ensure.
> Ok we discussed:
> nonce=PRF(key, index) . 
> index =segment length + tcp header without dport&sport. The index can
> include all the tcp header including options, but the fields (like port
> numbers) that won't change within a connection can be omitted, fields that
> are set to be zero in mac culculations can also be omitted.
> The problem is:
> In a tcp connection, before a seqnum rollover (when rollver happens, both
> hash key and PRF key need to be renewed), index must be different when the
> authenticated content described in tcpm-tcp-auth-opt-00 is different. Hence
> the calculation nonce=PRF(key, index) will give different values.
> Proof: 
> When the authenticated content changes, there are just two cases: seqnum
> changes or not. 
> If seqnum changes the index changes.
> If seqnum does not change, segment length either changes or not:
> 	If segment length changes, index changes;
> 	If segment length does not change, changes can only come from TCP
> header
>  	including option, in this case, the index also changes.

Please indicate the proof for this. First, it requires that the rest of
the system enforce the "no reuse of keys during seqno rollover"; second,
it requires that TCP implementations not allow the socket data to change
between initial transmission and retransmission.

Although I wouldn't think such data changes would be useful, I wouldn't
want to require FIPS validation of that property, since it creeps down
into the socket layer.

Joe