Re: [saag] [Cfrg] Re: TCP-AO MAC algorithms

[Sean Shuo Shen <[e-mail]>]

Hi Joe,

>Please indicate the proof for this. First, it requires that the rest of
>the system enforce the "no reuse of keys during seqno rollover"; second,
>it requires that TCP implementations not allow the socket data to change
>between initial transmission and retransmission.
First, I remember somewhere it is said that the MAC key should be renewed
when sequence number rollover, in your first email you also mentioned that
"This is why we probably need to explicitly require that the connection key
change whenever the sequence number rolls over (through the ISN)." I believe
you are giving a reasonable and achievable requirement (hash key renewing
during rollover). If hash key renewing during rollover is doable, nonce key
renewing during rollover is also doable and it's not an extra requirement.
The way to renew keys is out of the scope of our discussion. I don't think
we have to give a key management scheme before talking about MAC algorithms.

Second, maybe there is a misunderstanding here. What I mean is: the nonce
generation algorithm can guarantee that nonce is different when the MAC
protected data are different (because some mac algorithms require different
nonce when hashing different messages). If the MAC protected data (I assume
this is what you mean by "socket data") are same between transmission and
retransmission, it is totally fine for nonce to be same. So I did not
require that TCP implementations not allow the socket data to change between
initial transmission and retransmission.
Regards

Sean