Subject: [multipathtcp] A question related to the 4th ACK in the MP_JOIN handshake

From: "Shuai Wang" <[email-masked]>
Date: Thu, 13 Apr 2017 16:45:00 +0800 (GMT+08:00)

Hi,

    As it is said in RFC 6824 that the 4th ACK packet (for responding ACK/MP_JOIN packet) is necessary in MP_JOIN handshake before sending data. And the reason is that "The initiator's authentication information is sent in its first ACK(the third packet of the handshake). This data needs to be sent reliably, since it is the only time this HMAC is sent; therefore, receipt of this packet MUST trigger a regulat TCP ACK in response, and the packet MUST be retransmitte if this ACK is not received."

    But in my opinion, the receiver can check whether this HMAC included in the third ACK is correct, so the receiver can know whether the sender is the original sender or not. For the above considerations, I think the 4th ACK packet is unnecessary.

    If my opinion is wrong, please help me to correct. Thank you very much!

Best wishes,

Shuai

---

From: "Sargent, Matthew T. (GRC-LCA0)[Peerless Technologies]" <[email-masked]>
Date: Thu, 13 Apr 2017 14:52:36 +0000

Hi Shuai,

> On Apr 13, 2017, at 4:45 AM, Shuai Wang <[email-masked]> wrote:
> 

The trick here is to think of this from the other direction. Suppose Host A opens a connection to Host B and that Host A sends the third packet of the handshake (ACK with HMAC information).

You are correct that if Host B receives this packet it has enough information to authenticate Host A or not. The problem is that Host A does not know whether Host B has received this packet and authenticated Host A or not. This is the purpose of the fourth ACK of the handshake. It lets Host A know that it has been authenticated and that it can send data to Host B.

Suppose the spec changed and we no longer have to send the fourth packet of the handshake. After Host A sends the third packet of the handshake you get two scenarios:

(1) Third packet of the handshake is lost. If A sends data to Host B right now Host B cannot accept the data since Host A has not been authenticated.

(2) Third packet of the handshake is received by Host B. If A sends data to Host B right now Host B could accept the data since Host A has been authenticated.

Note that with the changed spec Host A does not have enough information to decide which case is true for a particular connection. 

The fourth ACK in the handshake removes the ambiguity for Host A:

(a) Third packet of the handshake is lost. Host A, expecting an ACK, is able to timeout and retransmit. 

(b) Third packet of the handshake is received. Host B sends an ACK, but the ACK is lost. Host A, expecting an ACK, is able to timeout and retransmit.

(c) The third packet of the handshake is received. Host B sends an ACK and Host A receives the ACK and now knows that it has been authenticated and can send data.

The fourth ACK gives an explicit signal to Host A that is has been authenticated and is able to send data to Host B. Even with some loss, if (a) or (b) occur, the retransmissions should eventually lead to (c). Once (c) happens, Host A has enough information to know that it should be able to send data to Host B.

Please let me know if that made sense or not.

Thanks,
Matt