Re: [tcpm] question about TCP-AO and rekeying

[Eric Rescorla <[e-mail]>]

At Thu, 18 Jun 2009 23:39:12 -0700,
Joe Touch wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> Eric Rescorla wrote:
> ...
> >> I agree that non-overlap is necessary to avoid injection. The trouble is
> >> that there are different ways to avoid non-overlap which we are
> >> currently leaving as "implementation dependent". If we leave them open,
> >> I am concerned that KMPs will not be able to ensure that two endpoints
> >> will pick corresponding MKTs for a given segment.
> > 
> > Really? I would imagine this is precisely the invariant that some
> > putative KMP would enforce.
> 
> If that's where we put that logic, what happens when we don't have a
> KMP? How do we know that both ends will do the same thing with a set of
> manually entered keys?

It was my understanding that the consensus was that we were not 
going to design a system that attempted to prevent user error.

Given that typographical errors in key entry seem far more likely
than this kind of misconfiguration, if our intent is to prevent
user error, then we should be attacking that first.

-Ekr