IETF Logo Mail Archive

Re: [tcpm] tcp-auth-opt issue: replay protection

Joe Touch <touch@ISI.EDU> Sat, 02 August 2008 02:23 UTC

Return-Path: <tcpm-bounces@ietf.org>
X-Original-To: tcpm-archive@megatron.ietf.org
Delivered-To: ietfarch-tcpm-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97F8828C1CA; Fri, 1 Aug 2008 19:23:45 -0700 (PDT)
X-Original-To: tcpm@core3.amsl.com
Delivered-To: tcpm@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A9B3828C1A2 for <tcpm@core3.amsl.com>; Fri, 1 Aug 2008 19:23:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.53
X-Spam-Level:
X-Spam-Status: No, score=-1.53 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DATE_IN_PAST_06_12=1.069]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VXdgHMUjMmlP for <tcpm@core3.amsl.com>; Fri, 1 Aug 2008 19:23:44 -0700 (PDT)
Received: from vapor.isi.edu (vapor.isi.edu [128.9.64.64]) by core3.amsl.com (Postfix) with ESMTP id 0384D28C199 for <tcpm@ietf.org>; Fri, 1 Aug 2008 19:23:43 -0700 (PDT)
Received: from [75.199.123.243] (243.sub-75-199-123.myvzw.com [75.199.123.243]) by vapor.isi.edu (8.13.8/8.13.8) with ESMTP id m722NI0x004128 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 1 Aug 2008 19:23:25 -0700 (PDT)
Message-ID: <48935983.80701@isi.edu>
Date: Fri, 01 Aug 2008 11:44:19 -0700
From: Joe Touch <touch@ISI.EDU>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: Adam Langley <agl@imperialviolet.org>
References: <20080728042451.C7A174B7AD3@kilo.rtfm.com> <488DD77D.9070608@isi.edu> <20080728144721.AC9184B905A@kilo.rtfm.com> <488DE021.7070307@isi.edu> <20080728164013.422D14B9600@kilo.rtfm.com> <F32F8EC5-70C9-4A7B-A2D2-B00CA43AECFA@nokia.com> <20080730213253.B347F4D52E1@kilo.rtfm.com> <4890E9AE.3000607@isi.edu> <20080731001609.6511C4D5E34@kilo.rtfm.com> <489175BD.6040201@isi.edu> <396556a20807311010k78c22981xa0eebd1b46e9f619@mail.gmail.com>
In-Reply-To: <396556a20807311010k78c22981xa0eebd1b46e9f619@mail.gmail.com>
X-Enigmail-Version: 0.95.6
X-ISI-4-43-8-MailScanner: Found to be clean
X-MailScanner-From: touch@isi.edu
Cc: tcpm@ietf.org
Subject: Re: [tcpm] tcp-auth-opt issue: replay protection
X-BeenThere: tcpm@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <tcpm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://www.ietf.org/mailman/private/tcpm>
List-Post: <mailto:tcpm@ietf.org>
List-Help: <mailto:tcpm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Sender: tcpm-bounces@ietf.org
Errors-To: tcpm-bounces@ietf.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Adam Langley wrote:
...
|> | So, two salient points:
|> | 1. When the sequence number is in the region of 0 (more precisely
|> |    while there are unacked segments on both sides of the region),
|> |    then the sides must maintain two keys and arrange to use
|> |    the appropriate one.
|>
|> Eric - can you explain "arrange to use the appropriate one"?
|
| I believe Eric is discussing the case where the keys change because of
| a rollover. Since packets may be reordered, a host past to remember
| both the keys for the previous period and the keys for the current
| period in case a reordered packet comes in. It's unclear, to me, which
| key retransmitted packets would use.

IMO: retransmitted packets would use the currently active keyID (even if
different from what was previously transmitted).

The ESN they would use would depend on the sequence number in the packet
(it can't depend on anything else, AFAICT). Using your 'nearness'
algorithm should suffice for that.

Joe


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiTWYMACgkQE5f5cImnZrvQwACePZOCwLg+MADrM7ar/siXmm8r
vrkAn0GSkVfaShDyDUcBqNb/8X32n3aw
=da0w
-----END PGP SIGNATURE-----

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm

v2.23.0 | Report a Bug | By Email