Re: [tcpm] tcp-auth-opt issue: support for NATs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Adam Langley wrote:
| On Wed, Jul 30, 2008 at 4:09 PM, Joe Touch <touch@isi.edu> wrote:
|> Should the document:
|>
|> a) require the socket pair info always be included in the MAC, i.e., be
|> protected
|>
|> b) allow a TSAD entry to indicate that the socket pair is excluded from
|> the MAC?
|>
|> Finally, does (b) help, given the current keying requirements?
|
| My assumption was that the TSAD could return the same keyset for all
| addresses and source ports going to a given destination/port pair. As
| an example, a listening socket could be configured such that one could
| only connect to it if one knew a key. (Standard proviso's here: the AO
| key itself should be a time rotating, secure derived key from the
| master secret). If one didn't have the key, not even a SYNACK would be
| sent in reply. Once a connection has been established, then the keys
| for that connection's 4-tuple can change independent of the wildcard
| keys.
|
| If that's a use case that the spec wishes to support, then having an
| option to exclude the pseudo-header and TCP port numbers from MAC
| protection would allow these connections to traverse NATs.

The current TSAD supports only a wildcard source port, which is
instantiated for the first connection received that matches. It expects
that the KMS installs additional keys as needed.

The above appears to require that the KMS deploy the same key for all
potentially overlapping NAT'd connections. This adds a requirement to
the KMS, but suggests that the pseudoheader is included or excluded for
all connections to a host from a given IP address. Is that what is
intended, or can you clarify? If that is what is intended, how can the
KMS enforce this?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiQ++gACgkQE5f5cImnZrseZACfSvxBHZt/PXSWLlvL7n06N77n
d7gAoO7h9NByaqSzUKewHlXV6io7OsaL
=dov+
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm