Subject: RE: [Hipsec] keymat / state machine problem with packet retransmission

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Fri, 29 Jul 2005 08:43:38 -0700

I don't know if this is a problem -- upon receiving the second R1, you can compare the R1 generation counter and decide that it is not greater than before, and drop the packet. Also, R1s are not retransmitted, so this "reflection" would have to be some effect of the network. Alternatively, if you receive the same R1 and you're in I2_SENT, it seems like you can retransmit your same I2 again, containing the same solution.

As your example B shows, it seems like your retransmitted I2s have different solutions. I would think that the retransmitted I2 is just a copy of the previous packet.

-Jeff

> -----Original Message-----
> From: Miika Komu [mailto:[email-masked]] 
> Sent: Friday, July 29, 2005 6:22 AM
> To: [email-masked]
> Subject: Re: [Hipsec] keymat / state machine problem with 
> packet retransmission
> 
> 
> On Fri, 29 Jul 2005, Miika Komu wrote:
> 
> > I discovered a problem in the state machine that may be 
> worthy of noting
> > the draft. I discovered a hint for the problem during 
> interops, and later
> > I could confirm it by running base exchange with the HIPL 
> implementation
> > so that each HIP control packet sent was repeated always N x times.
> 
> Let me elaborate more with two examples:
> 
> Example A: C and D happen simultaneously:
> 
> a) ---->  I1
> b) <----  R1
> c) -----> I2
> d) <----  R1  reflection of R1 (exactly the same as in b): initiator
>               processes again!
> e) ------> I2 the cookie solution must be same as in c, otherwise
>               end-up with mismatching keymat
> e) <---- R2
> 
> Example B: d and e happen simultaneously:
> 
>   init   resp
> 
> a) ----> I1
> b) <---- R1
> c) -----> I2
> d) <---- R2
> e) -----> I2 the cookie solution must be same as c, otherwise
>              end-up with mismatching keymat
> 
> Unless my thinking is incorrect, some text should be added that the
> initiator must remember the cookie solution it sent in I2 (and not to
> calculate a new one) upon retransmissions. The same applies 
> for the SPI
> value.
> 
> -- 
> Miika Komu              [email-masked]          http://www.iki.fi/miika/
> 
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/hipsec
> 

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec