Re: [tcpm] tcp-auth-opt issue: support for NATs

["Adam Langley" <[e-mail]>]

On Wed, Jul 30, 2008 at 4:09 PM, Joe Touch <[e-mail]> wrote:
> Should the document:
>
> a) require the socket pair info always be included in the MAC, i.e., be
> protected
>
> b) allow a TSAD entry to indicate that the socket pair is excluded from
> the MAC?
>
> Finally, does (b) help, given the current keying requirements?

My assumption was that the TSAD could return the same keyset for all
addresses and source ports going to a given destination/port pair. As
an example, a listening socket could be configured such that one could
only connect to it if one knew a key. (Standard proviso's here: the AO
key itself should be a time rotating, secure derived key from the
master secret). If one didn't have the key, not even a SYNACK would be
sent in reply. Once a connection has been established, then the keys
for that connection's 4-tuple can change independent of the wildcard
keys.

If that's a use case that the spec wishes to support, then having an
option to exclude the pseudo-header and TCP port numbers from MAC
protection would allow these connections to traverse NATs.


AGL

-- 
Adam Langley [e-mail] http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm