Subject: Re: [tcpm] tcp-auth-opt issue: keyID randomness

From: Ron Bonica <[email-masked]>
Date: Mon, 04 Aug 2008 13:41:47 -0400

Joe,

I don't think that the TSPI/keyID should be selected at random. The 
range of values is so small that guessing the value is trivial.

                                 Ron

Joe Touch wrote:
> As per Ran's request, should the keyID be selected at random to enable
> early discard algorithms, e.g., to reduce the impact of an attacker who
> would need to guess a valid keyID value?
> 
>     I discussed this issue with Ran, and suggested that all crypto
>     properties should be contained in the MAC field; such a field
>     might include a 'hard to guess' arbitrary fixed part and a
>     computed (e.g., HMAC) part, to enable efficient 'triage'
>     of randomly-generated DOS packets.
> 
> Overall, this suggests that the document could note that the keyID is
> NOT intended for protection, and any valid values may be used at any time.
> 
> Comments (esp. from Ran, who raised the issue)?
> 
> 
> 
_______________________________________________
tcpm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tcpm

_______________________________________________
tcpm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tcpm