Re: [tcpm] tcp-auth-opt issue: support for NATs

["Dan Wing" <[e-mail]>]

> At Mon, 11 Aug 2008 14:19:01 -0400,
> Ron Bonica wrote:
> > 
> > 
> > > That's a reason we have a keyID, which, together with the 
> socket pair,
> > > should exactly specify what key to use and avoids this 
> sort of trial.
> > 
> > Amen!
> > 
> >   If
> > > we can live with trials, we can remove the keyID and 
> things align much
> > > better.
> > > 
> > 
> > But we can't!
> 
> If we can't ever have trial authentication than there must be a unique
> key for each (key-id, remote addr) pair. As a practical matter,
> this implies either that:
> 
> - Key-ids must be globally unique.
> - You need to know the other side's IP address, even if you're doing
>   a passive open.

Adding 32 bits to the key-id would create the same global uniqueness
that using the source IPv4 addresses accomplishes.

But it's only necessary to have a globally unique key-id when a new
connection arrives:  after that, you can use the source IP address
and TCP port.  A reasonable optimization could involve using a 
shorter key-id after the TCP session is established.

-d

_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm