Re: [tcpm] Fwd: New Version Notification for draft-gont-tcpm-rfc1948bis-00

[Fernando Gont <[e-mail]>]

Joe,

On 10/01/2011 06:11 p.m., Joe Touch wrote:
>>> The specification of the PRF needs to be more detailed. I.e., state how
>>> the hash is padded, byte order, and what portion of the output you're
>>> using (since MD5 hashes are too long).
>>
>> How come that you don't deem this one as an implementation detail that
>> should not concern us?
> 
> The question is really "what is this document requiring".
> 
> Is your intent to say "use MD5", and figure the rest our yourself?

MD5 would be a good choice. But if you want to use something else,
that's still fine.


> If so, why bother using the "+" operator, or putting the time value
> outside the hash?

Joe, please read the I-D. The time value is put outside the hash such
that the ISNs increase over time.


>> -- We do want the ISNs to be monotonically increasing across connections
> 
> The alg you gave is monotonically increasing across connections within a
> socket pair. Presumably that's what you mean, right?

Yes.


>> It's a SHOULD not a MUST. So, if anything "what are the reasons for not
>> implementing this? -- Performance"?
> 
> 1) per-connection computational overhead
> 
> 2) the need to retain per-socketpair state for TW (vs., e.g., some
> *known* implementations that do otherwise to reduce the state needed to
> avoid TW reuse).

I don't know what you're talking about. What's the increased state that
you'd need to retain if you implement this algorithm.

The algorithm is *stateless*! (apart from the global counter).



>>>> Anyway, this document is not about the TIME-WAIT state. And proper
>>>> references are included where appropriate (e.g., the reference to the
>>>> CPNI TCP security document)
>>>
>>> If the result of this SHOULD impacts TW performance, then yes, it is
>>> about TW state.
>>
>> Can you clearly state what your concern is? -- I just don't follow.
>>
>> And... What does RFC 1948 have to do with TIME-WAIT performance?
> 
> If you generate ISNs that are monotonic within a socket pair, but are
> otherwise arbitrary across different socket pairs, you NEED to keep the
> TWs per socket pair. If you want to keep less TW state, you can use a
> different mechanism.

Isn't keeping the socket in the TIME-WAIT state a requirement?

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1