Re: [tcpm] tcp-auth-opt issue: replay protection

On Thu, Jul 31, 2008 at 1:20 AM, Joe Touch <touch@isi.edu> wrote:
> <individual hat on>
> My goal was to allow TCP-AO code to be isolated to handling packets just
> before exit/entrance to IP. That suggests that all TCP-AO state should
> be kept to the TSAD, and not extend the core TCP code unless absolutely
> necessary.

Speaking for the Linux stack, the current MD5 code filters at the
entry to the TCP layer since it needs to be near the options parsing
code etc. At that point, we have found a socket and thus have a locked
tcp_sock structure. So adding the ESN would involve adding a couple of
u32's to the tcp_sock structure (they would store the upper 32-bits of
the RX and TX ESNs).

> A separate question is whether ESN rollover should use the keyID
> mechanism or not. This is related to Eric's points:

Personally, my feeling is that it shouldn't.

> | So, two salient points:
> | 1. When the sequence number is in the region of 0 (more precisely
> |    while there are unacked segments on both sides of the region),
> |    then the sides must maintain two keys and arrange to use
> |    the appropriate one.
>
> Eric - can you explain "arrange to use the appropriate one"?

I believe Eric is discussing the case where the keys change because of
a rollover. Since packets may be reordered, a host past to remember
both the keys for the previous period and the keys for the current
period in case a reordered packet comes in. It's unclear, to me, which
key retransmitted packets would use.

> | 2. The same key-id is used in the packet regardless of the which
> |    key is being used to protect the traffic. It refers to the
> |    static key from which the traffic keys were diversified.
>
> Eric - can you explain where the multiple keys per keyID are determined?
> i.e., are they recomputed per-packet or kept somewhere?

It appears that they are computed when a connection becomes
ESTABLISHED and rotated once every rollover from then.

> <individual hat on>
> FWIW, I agree with Eric's example on the wire; the issue is the state
> required at the endpoints required to make it happen.
> <individual hat off>
>
> Comments?

I would prefer, for simplicities sake, that the MAC simply include an
ESN rather than roll the keys over, but not strongly.

AGL

-- 
Adam Langley agl@imperialviolet.org http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm