Re: [tcpm] 64-bit sequence numbers

[Joe Touch <[e-mail]>]

Hi, Jonathan (et al.),

A few issues:

1) why do you want to use all 64 bits for the TCP-AO MAC, but only the
low 32 bits for the KDF? The latter won't help with backward
compatibility, so why do this? FWIW, one mode of TCP-AO ignores options;
I don't see how you can say "ignore options" (experimental - RFC6978).
This doc probably needs to explain what happens when "ignore options" is
set (for NAT traversal), i.e., the sequence number extensions will be
ignored completely for TCP-AO in that case, AFAICT.

2) the doc should address how to handle RSTs, esp. if the state goes
away. It seems like a connection negotiated with 64-bit sequence numbers
can't ever be reset if the connection state is lost (all the RSTs will
be treated as out of window

3) there are more things than just TCP-AO that use ISNs as input; it
seems like you need a blanket statement on how they're handled. This
also then seems to kill automatic fall-back, AFAICT.

4) the doc needs to explain the impact of using this feature on each
segment on the TCP option space

5) the doc should probably address the impact of odd middleboxes, e.g.,
that split or splice segments or change sequence numbers

That's just scratching the surface; I fear this is a Gordian knot of
issues for which there is no simple sword.

Joe