Subject: [tcpinc] New tcpcrypt, API drafts posted

From: Daniel B Giffin <[email-masked]>
Date: Wed, 2 Nov 2016 20:40:42 -0700

A couple days ago we submitted updates to these two drafts:

  https://datatracker.ietf.org/doc/draft-ietf-tcpinc-tcpcrypt/

  https://datatracker.ietf.org/doc/draft-ietf-tcpinc-api/

The API section of tcpcrypt has been merged into draft-ietf-tcpinc-api.

The other significant changes to tcpcrypt are:

  - Adopt the nomenclature changes ("TEP", "glt", etc.) made
    to the most recent draft of TCP-ENO

  - 3.2 Protocol negotiation: Clarify the semantics of
    signaling for session caching, explaining that "sending
    a resumption suboption also implies willingness to
    perform fresh key-exchange with the indicated TEP."

  - 3.4 Session caching: Constrain the circumstances in
    which resumption suboptions may be sent:

      In a particular SYN segment, a host SHOULD NOT send more than one
      resumption suboption, and MUST NOT send more than one resumption
      suboption with the same TEP identifier.  But in addition to any
      resumption suboptions, an active opener MAY include non-resumption
      suboptions describing other key-agreement schemes it supports (in
      addition to that indicated by the TEP in the resumption suboption).

Regarding interactions with TFO: The tcpcrypt specification
does not define the semantics of data in a SYN+ENO segment,
so the new language in TCP-ENO's section on "Data in SYN
segments" dictates that a tcpcrypt implementation MUST NOT
send such data.