Re: [tcpm] AO-04: proposed text for describing all the traffic keys

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

See end of section 7.2, which describes the four keys, their derivation,
and their use.

Joe

Gregory M. Lebovitz wrote:
> I sent this to Joe before -04 was published, but he didn't have time to
> include it. I send it to list for review. I believe this text makes it
> quite explicit how many traffic keys for each connection there will be,
> and how they are contructed.
> 
>     > === BEGIN TEXT =====
>     > Because the Traffic key is created with conn_block as an input,
>     and part
>     > of Conn_block is the SourceISN and DestinationISN, each peer will
>     > generate multiple direction-specific traffic keys for each TCP
>     > connection in the following format:
>     >
>     >     Kx,y^N = F(s, d)
>     >
>     > Where:
>     >    a - Alice, the initiator of the TCP connection,
>     >    b - Bob, the other end-point in the TCP connection,
>     >    Kx,y - Conn_Key of directionality x,y , where x is the segment
>     > source, either a or b, and y is the segment destination, either b
>     or a,
>     >    ^N - where N is an integer labeling a unique traffic key for a
>     > specific sender for this connection,
>     >    F - abstractly, the funtion of the KDF where the elements
>     within the
>     > parenthesis are changing variables, and all other KDF elements are
>     > understood as held constant, or irrelevant to the description,
>     >   (s, d) - where h is the Source ESN and i is the Destination ESN,
>     >
>     > Following this format, the traffic keys generated on Alice and Bob
>     > respectively for a normal, one way open TCP connection will be
>     three each:
>     >
>     >         ALICE                               BOB
>     >        ========                           ========
>     >
>     > 1|  Ka,b^1 = F(ISNa, 0)    ------->  Ka,b^1 = F(ISNa, 0)
>     > 2|  Kb,a^2 = F(ISNb, ISNa) <-------  Kb,a^2 = F(ISNb,ISNa)
>     > 3|  Ka,b^3 = F(ISNa, ISNb) ------->  Ka,b^3 = F(ISNa, ISNb)
>     >
>     >
>     > In the above,
>     >    - line 1 is a SYN from a to b.
>     >    - line 2 is a SYN/ACK segment from b to a
>     >    - line 3 is an ACK segment from a to b
>     >
>     > Thus, in the simple case, each side creates 3 Traffic keys, ^1,
>     ^2, and ^3.
>     > In the more rare case where there is a simultaneous open [REF??], each
>     > side will generate four traffic keys:
>     >
>     > 1|  Ka,b^1 = F(ISNa, 0)    ------->  Ka,b^1 = F(ISNa, 0)
>     > 2|  Kb,a^2 = F(ISNb, 0)    <-------  Kb,a^2 = F(ISNb, 0)
>     > 3|  Kb,a^3 = F(ISNb, ISNa) <-------  Kb,a^3 = F(ISNb,ISNa)
>     > 4|  Ka,b^4 = F(ISNa, ISNb) ------->  Ka,b^4 = F(ISNa, ISNb)
>     >
>     > In the above,
>     >    - line 1 is a SYN from a to b.
>     >    - line 2 is a possible simultaneous open SYN from b to a
>     >    - line 3 is a SYN/ACK segment from b to a
>     >    - line 4 is an ACK segment from a to b
>     > === END TEXT ======
> 
> Thoughts?
> 
> Gregory.
> 
> +++++++++++++++++++++++
> IETF-related email from
> Gregory M. Lebovitz
> Juniper Networks
> g r e go r  y d o t  i e tf a t  g m a i l  do t c o  m
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAknH26sACgkQE5f5cImnZrt05QCfekYPs+TgPvlP8qzn7GzTe+71
hw0AoOkA+Nk40WMaCLuV8pEjpY6K7u+T
=6XS2
-----END PGP SIGNATURE-----