Re: [tcpm] question about TCP-AO and rekeying

[Eric Rescorla <[e-mail]>]

At Mon, 22 Jun 2009 12:16:16 -0500,
Eddy, Wesley M. (GRC-MS00)[Verizon] wrote:
> 
> Since this thread has turned into ping-pong between Joe and
> Eric, I'll break that pattern by putting in my assessment as
> a WG participant ...
> 
> I think Eric's explanation that if multiple MKTs can be
> matched to the outgoing SYN, then we can pick from them in
> an implementation-dependent way, as long as we pick one key,
> makes sense.  Yes, we can add complexity to disambiguate
> how that selection is made as part of our spec (TSAD/TAPD),
> but after reading the thread, I don't see clear value in that.

I note that if we don't like this, then the problem isn't 
particular to overlap. Even if we only allowed exact matches
and prohibited overlap, we still have the question of how
to deal with two keys that have been inserted for the same
connection. For instance, say we have some connection
which is operating on key A.

Then Alice injects B and C in that order. Bob injects C and B
in that order. I thought we'd agreed that that was OK and that
we were happy to end up with a setting in which we had C in
one direction and B in the other. If not, we need some 
more sophisticated ordering rule.

-Ekr