Re: [tcpm] question about TCP-AO and rekeying

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Eric Rescorla wrote:
...
>> However, the invariant is twofold:
>>
>> 	a) for a given packet, only one MKT applies
>>
>> 	b) for two endpoints with multiple MKTs,
>> 	the *same* MKT applies.
> 
> I don't see that this is true. As I understand the current design
> there's no reason that both sides can't use different MKTs
> indefinitely.

Each side can use a different MKT to transmit. However, if side A uses
MKT X to transmit, then side B needs to know to use MKT X to receive. If
side A matches MKT X on transmit and side B matches MKT Y on receive,
then there's a problem for that connection.

So let's rephrase, recognizing that there are two MKTs at any given time
(one for transmit on each side, and the same pair for receive on the
opposite side).

b) for two endpoints, if a given packet matches MKT on one side during
transmit, it must match the corresponding MKT on the other side during
receive.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAko4jDYACgkQE5f5cImnZrtN/ACg+auD2x3yiHy6owI5aeUCePf7
M0IAoKAniNQHEBTxl6LIoSrixtwS4G9m
=8v0e
-----END PGP SIGNATURE-----