Re: [tcpm] Minimum nonce length in draft-touch-tcpm-experimental-options

["SCHARF, Michael" <[e-mail]>]

> >> Does that statement intend to say something like "MUST NOT 
> be shorter 
> >> than 16 bits long"? Or shall even a nonce of length 0 be allowed, 
> >> provided that there are additional security mechanism such as 
> >> checksums or digital signatures? In the latter case, 
> existing use of 
> >> the codepoints without nonce could be compliant to the 
> >> recommendation, provided that there are other means to 
> detect false positives.
> > 
> > I don't have strong opinion on this yet, but I personally think we 
> > don't have to mention minimum length specifically in the draft.
> > However, I might prefer to put a little bit more stress in 
> this regards, like,
> >   o It's implementor's responsibility to find good balance 
> between the 
> > overhead of magic number and the overhead to handle false positive.
> >   o the draft doesn't guarantee anything even if an implementor 
> > chooses longer magic number
> 
> I agree. Given the scarcity of TCP option space, you do not 
> want to use any more space for the magic number than 
> necessary. Maybe one possible option could be to use a 32-bit 
> magic number in the SYN handshake, to declare that for the 
> rest of that connection option types 253 and 254 are used 
> without magic number for feature X (or perhaps with a shorter 
> magic number, to allow simultaneous experimental features). 
> This could be useful when the option space is expected to get tight.

Option space is particularly scarce in SYNs. Afterwards one could try to
piggyback a long option to an empty ACK instead. Thus, this only helps
if a rather long option must indeed be present in a data segment, right?

Michael