Re: [tcpm] Review of draft-ietf-tcpm-tcp-auth-opt-01

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Anantha Ramaiah (ananth) wrote:
| Folks,
|    The extended feeling which I get after watching some of the
| conversation is that we seem to be in a cherry picking mode of what to
| include/exclude in the digest (MAC) computation. (psuedo header, TCP
| options etc.,)
|
| So, if we are going down that route, then I would argue it may be
| worthwhile to debate "how much" to include in general, i.e, is it
| worthwhile to include selective portions OR part of the data portion of
| the TCP data in the MAC computation instead of he entire data.?

Absolutely; that can be implemented inside the MAC algorithm, opaquely
to TCP-AO, though. I.e., I can create a MAC that hashes only the odd
blocks, only the first half of the blocks, etc.

Whether or not there are options to that MAC or not that need to be
coordinated end-to-end is up to the key management system; e.g.,
parameters like "just the firs 10 bytes" can be encoded - again opaquely
to TCP-AO - in the key used on a connection.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiPHeAACgkQE5f5cImnZrsG/gCgzGx7+U61UfV2YHNj+JWh0WWy
qm4AoMgckf9M8yD3h4WnkjwDHLST3TpQ
=Mt+Y
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm