Subject: [tcpm] tcp-auth-opt issue: keyID randomness

From: Joe Touch <[email-masked]>
Date: Wed, 30 Jul 2008 16:00:00 -0700

As per Ran's request, should the keyID be selected at random to enable
early discard algorithms, e.g., to reduce the impact of an attacker who
would need to guess a valid keyID value?

	I discussed this issue with Ran, and suggested that all crypto
	properties should be contained in the MAC field; such a field
	might include a 'hard to guess' arbitrary fixed part and a
	computed (e.g., HMAC) part, to enable efficient 'triage'
	of randomly-generated DOS packets.

Overall, this suggests that the document could note that the keyID is
NOT intended for protection, and any valid values may be used at any time.

Comments (esp. from Ran, who raised the issue)?

_______________________________________________
tcpm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tcpm