Re: [tcpm] tcp-auth-opt issue: support for NATs

"Adam Langley" <> Wed, 30 July 2008 23:22 UTC

Return-Path: <>
Received: from [] (localhost []) by (Postfix) with ESMTP id 79DFA3A6A46; Wed, 30 Jul 2008 16:22:33 -0700 (PDT)
Received: from localhost (localhost []) by (Postfix) with ESMTP id BA5163A69C1 for <>; Wed, 30 Jul 2008 16:22:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id N53eabLElzwO for <>; Wed, 30 Jul 2008 16:22:32 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 077453A68A1 for <>; Wed, 30 Jul 2008 16:22:32 -0700 (PDT)
Received: by with SMTP id b25so231483rvf.49 for <>; Wed, 30 Jul 2008 16:22:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references :x-google-sender-auth; bh=O6RnZPWUHH49l9kt4eHIoTtCG+rNm9NAGFV44KaJhu0=; b=CWnS5OmQc9yA0BdefYyKe/Gv8slNzqpUxu9HpmLojDfKug/L/A1E+2QLd1yTBL8xIY ZreVd2Q8obCyhasZNYm1UEwVFgeMCutpjW4/N2O8UKrpFtlabwIGQGPJPhXGy7MvhPOP qg3UPhjimu+5t+sSd5Y18BCKCj1nHE0euPx5M=
DomainKey-Signature: a=rsa-sha1; c=nofws;; s=gamma; h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references:x-google-sender-auth; b=fObkvPG/XG6pRxqmzB5DXXpKBQFQopRHoLZaDtcrYJvU0z5tlefd5uEh5mz6+AqAdd QRhjS8lPHndzgCaHqGAqak+jKUhuL88VavT7WusiYKae1Xf+RbbpQgd9It/JO6lPaopF T6y31UzaMdKuBXPr/OmNfpG0SJamLAVutfpPk=
Received: by with SMTP id i13mr4912383rvq.100.1217460167934; Wed, 30 Jul 2008 16:22:47 -0700 (PDT)
Received: by with HTTP; Wed, 30 Jul 2008 16:22:47 -0700 (PDT)
Message-ID: <>
Date: Wed, 30 Jul 2008 16:22:47 -0700
From: Adam Langley <>
To: Joe Touch <>
In-Reply-To: <>
MIME-Version: 1.0
Content-Disposition: inline
References: <>
X-Google-Sender-Auth: c1208b4fd5acf988
Subject: Re: [tcpm] tcp-auth-opt issue: support for NATs
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

On Wed, Jul 30, 2008 at 4:09 PM, Joe Touch <> wrote:
> Should the document:
> a) require the socket pair info always be included in the MAC, i.e., be
> protected
> b) allow a TSAD entry to indicate that the socket pair is excluded from
> the MAC?
> Finally, does (b) help, given the current keying requirements?

My assumption was that the TSAD could return the same keyset for all
addresses and source ports going to a given destination/port pair. As
an example, a listening socket could be configured such that one could
only connect to it if one knew a key. (Standard proviso's here: the AO
key itself should be a time rotating, secure derived key from the
master secret). If one didn't have the key, not even a SYNACK would be
sent in reply. Once a connection has been established, then the keys
for that connection's 4-tuple can change independent of the wildcard

If that's a use case that the spec wishes to support, then having an
option to exclude the pseudo-header and TCP port numbers from MAC
protection would allow these connections to traverse NATs.


Adam Langley
tcpm mailing list