Re: [tcpm] tcp-auth-opt issue: support for NATs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi, all,

<indiv hat on>

I think the discussion on the issue of keyID uniqueness and the size of
the keyID space indicates a deeper issue about keyIDs, as well as the
TCP-AO option.

The keyID is currently only an *intra-connection* identifier. It's sole
purpose is to avoid testing multiple concurrent keys and configurations
on a single connection, as would occur during rekeying. The primary
security association identifier for a connection is the socket pair
(addr/port pair).

The TCP-AO option provides authentication; it does not provide automated
~ key or parameter negotiation. IMO, that is better left to an automated
KMS.

- ---

There are certainly a number of issues that all appear to require more
than simple, static keying in TCP-AO can handle:
	- dynamic endpoint address assignment
	- NATs
	- passive open with floating source IP address

IMO, these can - and should - be handled more easily by an automated
KMS. This would leave TCP-AO much simpler and easier to validate. The
alternatives are problematic:
	- create and manage our own unique connection ID space
	- test all concurrently overlapping keys/configurations
	until each connection is resolved

I thus feel that it's OK to say that the simplest static key
configuration of TCP-AO solves some problems and not others. The
problems we can solve (or have already solved) are:

	- unique per-connection keys (based on ISNs)
	- replay prevention using automated key rollover
	- passive open with floating source port only

Solving NATs, dynamic IP address assignments, and full passive opens for
statically configured keys will, AFAICT, require relaxing authentication
to the point where we will end up developing an in-band KMS in the SYN
packet, which I feel is complexity we can avoid.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkijPfwACgkQE5f5cImnZrtyvwCgs+QPQ0rBD+rm8sx5Um75/Dss
eFIAoLeNaG8fZh7DjIHJsCUYorqKOUki
=0aQt
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm