[tcpinc] New draft of tcpcrypt posted

[Daniel B Giffin <[e-mail]>]

We've posted a new draft of tcpcrypt:

  https://datatracker.ietf.org/doc/draft-ietf-tcpinc-tcpcrypt/

In addition to general improvements to the language, the substantive
changes to the protocol are as follows:

3.5.  Session caching

To identify a cached session for resumption, tcpcrypt previously sent
a prefix of the session ID in the clear.  But this conflicted with a
requirement in TCP-ENO:

   o  Unless and until applications disclose information about the
      session ID, all but the first byte MUST be computationally
      indistinguishable from random bytes to a network eavesdropper.

So the new tcpcrypt draft instead uses a distinct constant to derive a
"resumption identifier" from the relevant session secret:

  resume[i] = CPRF(ss[i], CONST_RESUME, 18)

Furthermore, where previously the active opener sent a nine-byte
identifier for the cached session and a passive opener agreed to
resume that session by sending an ENO suboption with `v = 1` but zero
suboption data, it now sends a *further* nine bytes of the identifier
(the second half of `resume[i]` above) in order to agree.  This
provides much more assurance against a collision of resumption
identifiers that would lead hosts to attempt communication with
incorrect keys.  It also avoids the need to permit zero-length data in
variable-length ENO suboptions.

Resumption continues to work with simultaneous open, as described in
the document. 

3.7.  TCP header protection

Where previously the document required recipients always to "ignore"
the TCP FIN flag in favor of the integrity-protected FINp, it now
says:

   When "FINp" is set, it indicates that the sender will send no more
   application data after this frame.  When the TCP FIN flag differs
   from "FINp", a receiving host MUST either ignore the segment
   altogether or abort the connection and raise an error condition
   distinct from the end-of-file condition.