[tcpm] tcp-auth-opt issue: replay protection

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Given Eric's points on this topic, as a way forward, there are a few
alternatives (comments requested)

1. assume the key management system (KMS) will rollover the keys every
2^31 bytes

	Eric noted this is weak, since we cannot rely on the KMS
	to act on this without other info. Let's presume this
	is unacceptable to the WG and move on...

2. include an extended sequence number (ESN) inside TCP-AO
	ESN starts at 0
	increment ESN when the TCP sequence number rolls over*
	passed ESN to the encryption algorithm as part of the MAC'd data

3. have TCP-AO ask the KMS to add a new key for the connection when the
sequence number rolls over (actually just before, e.g., 2^31 rolls over)

- ------------------------------------

#2 is internal to TCP-AO, i.e., it requires no 'callback' to the KMS
There appears to be a synchronization issue here - exactly when is the
ESN incremented? Suppose endpoints A and B; there are two ESNs - ESN_ab
and ESN_ba:
	A increments ESN_ab when A receives an ack from B w/seqno > 2^31
	B increments ESN_ab when B sends an ack to A w/seqno > 2^31
	B increments ESN_ba when B receives an ack from A w/seqno > 2^31
	A increments ESN_ba when A sends an ack to B w/seqno > 2^31
i.e., the ESN is incremented when the reverse channel succeeds; we can't
use the forward channel, since one side would change the ESN in ways the
other would never notice (it wouldn't decode it)

Given that algorithm, every ESN increment would trash data in transit
from A-B. Is there an algorithm that does not do this?

- -------------------------------------

#3 allows packets to be reordered without loss during key rollover, and
is not susceptible to the burst-losses of #2

Note that #2 should not 'insert a key into the TSAD' - that interface
should be under the exclusive control of the KMS - at which point asking
the KMS to keep that info (or bury it in the TSAD where the KMS can
refer to it) seems sufficient.

Comments?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiQ6a4ACgkQE5f5cImnZruZ7ACfRfobhbIZYd/t4xZinRjqMNHp
AwgAn0hNl3OS50CRmx35wngpGrUBzqfo
=DPd7
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm