Re: [tcpm] tcp-auth-opt issue: support for NATs

On Fri, Aug 1, 2008 at 12:11 PM, Joe Touch <touch@isi.edu> wrote:
> Key rotations (presumably you're talking about the master key) may
> require some synchronization, which seems unlikely in the case of NATs
> as well.

A time based key rotation would only require that endpoints have
synchronised clocks to within an arbitrary amount of time. A minute
would seem reasonable.

> There are a few questions that may be useful to address to move forward:
>
>        - is the use of wildcards/ingore addrs/ports compatible with
>        the desire for unique per-connection keys?

Unless the SEQ/ACK randomness is compromised, 64-bits of random data
should be enough I believe. If the randomness *is* compromised, then
adding in the ports and addresses to the calculation does little for
security since those values are known.

>        - is it OK to require that all NAT'd clients use the same
>        key

In the cases where people would consider setting things up this way
(when manual/automatic key distribution is too burdensome) then I
would suggest, yes.

>        - is it OK to require that support for NATs means
>        using wildcard'd keys?

Again, I would say yes. Noting that this scheme (wildcarding keys)
does not prohibit manual or automatic key distribution. It's simply a
low-setup-cost addition to those schemes.

AGL

-- 
Adam Langley agl@imperialviolet.org http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm