Re: [tcpm] SHA-2 auth draft on TCP-AO

[Brandon Williams <[e-mail]>]

Hi Sunjeet,

The mac lengths of the algorithms specified here increase the option 
size, don't they? There is a detailed discussion of the option space 
tradeoffs for tcp-ao in rfc5925 section 7.6, which is based on the fact 
that all mac lengths would be 96 bits. An I.D. that increases the 
possible mac lengths should probably revisit that discussion.

In particular, the use of a 256 bit mac length would mean that the most 
commonly used TCP options must be discarded in favor of TCP-AO. On the 
SYN, you would have just enough room for MSS and that's it. On systems 
that word align options, there isn't even enough space available for a 
128 bit mac length on the SYN, and such systems would also be unable to 
support both timestamps and SACK.

Regards,
--Brandon

On 06/03/2014 03:21 AM, Sujeet Nayak A (sua) wrote:
> Hi,
> In the last few months, we have been seeing a lot of customer interest
> for SHA-2 based auth on TCP-AO enabled connections. In this regard, we
> (Brian Weis and myself) have posted a draft for the same:
> http://tools.ietf.org/html/draft-nayak-tcp-sha2-00
>
> Pl. review and let me know your valuable comments.
>
> Regards,
>
> Sujeet Nayak A.

-- 
Brandon Williams; Senior Principal Software Engineer
Emerging Products Engineering; Akamai Technologies Inc.

-- 
Brandon Williams; Senior Principal Software Engineer
Emerging Products Engineering; Akamai Technologies Inc.