Re: [tcpm] tcp-auth-opt issue: replay protection

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Adam Langley wrote:
...
| The ESN is just a 64-bit sequence number. The SEQ field in the TCP
| header is just the lower 32-bits of this counter. Thus, for the
| half-connection from A to B, A knows the ESN exactly for every packet.
| For a packet recved by B, it guesses the ESN based on the closest
| value to it's last understanding. An example for B:
|
| At the beginning of the connection, B knows the ESN for the A->B half
| connection exactly: top 32-bits are 0, bottom 32-bits from the
| handshake.
| For each packet recved it gets the low 32-bits of the ESN, now assume
| that that the ESN is the closest of the 2**32 possible ESN's to the
| previous value of the ECN.

Can you explain the algorithm for "closest"?

| Update the previous value with this new guess.
|
| This is very easy code.
|
| Any packets which are reordered > 2**32 sequence bytes will be
| misclassified and dropped, but 2**32 sequence bytes is a long way.

<individual hat on>

If you update the ESN on the first packet whose Seqno causes you to
determine a rollover, won't any packets that are reordered around it be
dropped? i.e.:

	packets with higher seqnos that arrive earlier cause
	the ESN to be updated earlier; all subsequent packets
	with the pre-increment ESN would be droppped

<individual hat off>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiQ9p4ACgkQE5f5cImnZruJuQCgieqH6F4onLrTZeM1876Leq5Z
sYwAoK3LVtQ/Ow3uiJ9Ntl5JKH3JQ1Hk
=hP94
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm