Re: [tcpm] Updated SHA-2 AO draft

[Brandon Williams <[e-mail]>]

Hi Sujeet,

I'm still concerned about whether there's enough space in the SYN header 
for this option. My concern is based mostly on a what I think is a flaw 
in the analysis from RFC5925 section 7.2, which leaves out the 4-byte 
MSS option. As the analysis from RFC6824 indicates, SYN packets 
typically include the MSS option, leaving only 21 bytes available in an 
option packed SYN and 16 in a worst-case unpacked SYN. TCP-AO with SHA1 
works in either case, but SHA2 only works (just barely) in an option 
packed stack.

Section 4 of your draft should probably be updated to account for the 
commonality of the MSS option and the related requirement either to drop 
one of the common SYN options or pack the option space.

--Brandon

On 10/28/2014 02:12 AM, Sujeet Nayak A (sua) wrote:
> Hi,
> Thanks everyone for your valuable review comments so far. Brian and
> myself have updated the draft to produce the next version.
> https://tools.ietf.org/html/draft-nayak-tcp-sha2-01
>
> Some of the high level changes made are:
>
>   * Because of TCP option space issue, SHA512 has been moved out of the
>     draft (a note added in the "Security Consideration" for future
>     support, when needed).
>   * Moved the motivation contents into the introduction section.
>   * Taken care of some of the RFC language related comments.
>
> Pl. review and let me know your feedback. On the other hand, if there is
> a consensus that, the contents need to update RFC5926, and if that RFC
> allows such an update, then we are happy to work with Greg on it.
>
> Regards,
>
> Sujeet

-- 
Brandon Williams; Senior Principal Software Engineer
Emerging Products Engineering; Akamai Technologies Inc.