Re: [tcpm] Review of draft-ietf-tcpm-tcp-auth-opt-01

[Eric Rescorla <[e-mail]>]

I did want to make one more note.

At Sun, 27 Jul 2008 23:38:32 -0700,
Joe Touch wrote:
> | - The discussion of key rollover seems incomplete
> |
> |       >> TCP-AO implementations SHOULD change keys for a connection at
> |       least every 2^31 bytes, to avoid resending segments with the same
> |       TCP sequence number, data, and length under the same key.
> |
> | How is this intended to work?
> 
> The key management mechanism should react to sequence numbers rolling
> over the ISN (perhaps masking out the high bit to roll over twice as often).

Regardless of whether there is a KMP, it strikes me as unwise to punt this
job to it. 

The TCP authentication protocol should be able to provide security for
packets even in the face of sequence number rollover, out to the
limits of security of the MAC algorithm (which far exceed 2^31 bytes
in both cases). There are (at least) two potential approaches:

1. Use a (synthetic) extended sequence number.
2. Change the key used to compute the MAC inside the protoco.

But I don't think it's a good idea to punt this to the KMP, since
you don't really need to change the key for any cryptographic reason.

-Ekr







_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm