Re: [tcpm] I-D Action:draft-ietf-tcpm-tcp-auth-opt-01.txt

On Mon, Jul 14, 2008 at 8:33 PM, Joe Touch <touch@isi.edu> wrote:
> The nonce is for generating per-session keys, not for per-packet operations.
> Per packet uniqueness is discussed in the replay section of the Security
> Considerations, and is governed primarily by the TCP sequence number, and
> the strong suggestion (elsewhere) to change the key every 2^31 bytes if
> uniqueness is a concern.

Right, sorry I misunderstood that.

> Option 4 is what we currently suggest, which is:
> use the 32-bit sequence number as the per-packet nonce, and encourage
> rekeying every 2^31 bytes or so.

Ok. That's what I called option one,

>        - it still provides a nonce (I don't see how to "disallow"
>        MACs that require a nonce. I don't know what a "strong"
>        nonce is, though - nonce just means unique. If 'strong'
>        means 'random', that's different (i.e., entropy inducer,
>        vs. just unique).

Some MACs accept a pair as their input (M,n) where n is a strong
nonce. These MACs require that a given nonce, n, never be used with
two different messages. If you do, then you may well be exposing key
information etc (the security proof is invalid so anything's
possible). Since we can't guarantee this, we just have to exclude them
I believe. Since the well known MACs (MD5, SHA family etc) are not of
this type it's not a big issue.

> I prefer including the expected addrs and port numbers for the following
> reason:
>
> 1. TCP-AO needs to know what the addr/port pair is at the receiver behind
> the NAT anyway in order to match keys to connections

Only in the case where a listening socket is configured with a list of
(source, key) pairs. That's the case with routers and BGP sessions
etc, but one could certainly imagine TCP-AO as a (better) alternative
to port-knocking schemes. Also, it doesn't work for connections where
the AO key is established by the application level after the TCP
handshake. (Although, in the latter case, one could argue that each
host should tell the other its NAT translated identity just to make AO
work).

AGL

-- 
Adam Langley agl@imperialviolet.org http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm