Re: [tcpm] TCP-AO: Text for New_Key Process

TCP doesn't *need* to send any packets. Whatever mechanism you design 
needs to assume that.

Also, "opportunistically" means that on some systems that packet would 
go through, and on others it wouldn't - depending on when the key was in 
place. So key placement would impact throughput (because TCP interprets 
loss as congestion). While the impact could be reduced by using SACK, 
etc., that's not a great place in the design space to play, IMO.

Joe

Eric Rescorla wrote:
> As previously noted, you can do automatic switchover without 
> changing the TCP state machine at all: you just opportunistically
> encrypt the occasional packet that would be sent already.
> 
> -Ekr
> 
> At Mon, 2 Feb 2009 17:02:58 -0500,
> Ron Bonica wrote:
>> +1
>>
>> Lars Eggert wrote:
>>> On 2009-1-27, at 23:34, Joe Touch wrote:
>>>> I was under the assumption that our design space was as close to TCP
>>>> MD5 as
>>>> possible, i.e., augment existing segments with a new option, but neither
>>>> generate nor consume new segments.
>>> That's my recollection as well, and hopefully it's in the minutes of the
>>> WG meeting where we adopted the work item. The idea was to be as
>>> lightweight (in terms of changes to TCP) as possible, and changes to the
>>> state machine, etc. seem rather heavyweight.
>>>
>>> Lars
>>>
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm