Re: [tcpm] TCP-AO Option Layout - Alignment and Padding

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi, Hideaki (et al.),

YOSHIFUJI Hideaki / ???? wrote:
| Hello.
|
| In section 3.2., TCP-AO Option is defined as follows (option 1):
|             +---------------------+---------+-------------------+
|             | Kind= TBD-IANA-KIND | Len=var |      MAC          |
|             +---------------------+---------+-------------------+
|             |              MAC (con't)            ...
|             +-------------------------------------...
|
|               ...-----------------+---------+
|               ...  MAC (con't)    |  KeyID  |
|               ...-----------------+---------+
|
| With this layout, An implementation will end up put it like this
|                                     +---------+---------+
|                                     | Kind=?? | Length  |
|                                     +---------+---------+
|                 +--------------...--+---------+
|                 |       MAC         |  KeyID  |
|                 +--------------...--+---------+

Why is this the case? IP with no options is 20 bytes; the base TCP is 20
bytes, so the options begin aligned; noting that most MAC sizes are
multiples of 4 bytes, the alignment is most likely to result in:

~                 +---------+---------+--------------------+
~                 | Kind=?? | Length  |   MAC...           |
~                 +---------+---------+--------------------+
~                 ...
~                 ....
~                 +-------------------+---------+
~                 |       MAC         |  KeyID  |
~                 +-------------------+---------+

In this case, the prepad is 0 and the postpad is 1, but the MAC is only
half-word aligned.

If we want to reduce padding and keep the MAC aligned, the best option is:

~                 +---------+---------+---------+---------+
~                 | Kind=?? | Length  |  KeyID  |   0     |
~                 +---------+---------+---------+---------+
~                 ...
~                 ...
~                 +---------------------------------------+
~                 |       MAC...                          |
~                 +---------------------------------------+

I.e., pad ourselves. We suggest that the option start word-aligned. This
wastes space, IMO.

I would favor a more economical approach that recognizes that a few bits
of MAC could be sacrificed for our KeyID, e.g.:

~                 +---------+---------+-----+--------------+
~                 | Kind=?? | Length  | KID |  MAC'...     |
~                 +---------+---------+-----+--------------+
~                 ...
~                 ....
~                 +-------------------+
~                 |       MAC'        |
~                 +-------------------+

Use 2 bits for the KID; 1 is insufficient, and 2 is more than sufficient
IMO.

The MAC' is a half-word aligned MAC with the top 2 bits overwritten
(i.e., it is NOT shifted right); the KID occupies those top 2 bits.

If a user wants word alignment, pick a MAC length of N-2 bytes.

Wouldn't that be simpler and more space efficient?

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiO8V8ACgkQE5f5cImnZrvd+wCg4JO7RFCZ0QMtb0l1UzHu+Zi8
NMgAoJJ88bwhDpoZIRvG1Gp4xphzM32F
=oNW1
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm