Re: [tcpm] tcp-auth-opt issue: support for NATs

At Thu, 07 Aug 2008 11:14:10 -0700,
Joe Touch wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> Eric Rescorla wrote:
> | At Thu, 7 Aug 2008 10:47:30 -0700,
> | Adam Langley wrote:
> |> On Wed, Aug 6, 2008 at 6:18 PM, Eric Rescorla
> <ekr@networkresonance.com> wrote:
> |>> I'm sorry, I must be missing something. what problem are you trying to
> |>> solve?
> |> The above was an sketch of how a passive open socket would work with
> |> TCP AO such that only clients that knew a master key could connect. If
> |> we wish to support a setup, then wildcard key matching would probably
> |> be needed.
> |
> | Because the side doing the passive open doesn't know which client
> | is connecting and it may have multiple instances of the same key-id?
> | I don't understand the purpose of the time. Just do trial verifications
> | with each key.
> 
> That's a reason we have a keyID, which, together with the socket pair,
> should exactly specify what key to use and avoids this sort of trial. If
> we can live with trials, we can remove the keyID and things align much
> better.

Yes, but this only works if you either (1) know the address of 
peers in advance or (2) never assign the same key-id to two
different peers.

-Ekr
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm