Re: [tcpm] Minimum nonce length in draft-touch-tcpm-experimental-options

[Pasi Sarolahti <[e-mail]>]

On Feb 28, 2012, at 10:14 PM, Yoshifumi Nishida wrote:

>> Does that statement intend to say something like "MUST NOT be shorter
>> than 16 bits long"? Or shall even a nonce of length 0 be allowed,
>> provided that there are additional security mechanism such as checksums
>> or digital signatures? In the latter case, existing use of the
>> codepoints without nonce could be compliant to the recommendation,
>> provided that there are other means to detect false positives.
> 
> I don't have strong opinion on this yet, but I personally think we
> don't have to mention minimum length specifically in the draft.
> However, I might prefer to put a little bit more stress in this regards, like,
>   o It's implementor's responsibility to find good balance between
> the overhead of magic number and the overhead to handle false
> positive.
>   o the draft doesn't guarantee anything even if an implementor
> chooses longer magic number

I agree. Given the scarcity of TCP option space, you do not want to use any more space for the magic number than necessary. Maybe one possible option could be to use a 32-bit magic number in the SYN handshake, to declare that for the rest of that connection option types 253 and 254 are used without magic number for feature X (or perhaps with a shorter magic number, to allow simultaneous experimental features). This could be useful when the option space is expected to get tight.

- Pasi