Subject: RE: [Hipsec] base-03 state machine, notify

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Mon, 1 Aug 2005 02:19:39 -0700

> (4) Under the NOTIFY parameter with INVALID_SYNTAX 7, the draft says
>"this status may only be returned for and in an encrypted packet if the
>message ID and cryptographic checksum were valid". What is meant by
>"message ID"? What about the "cryptographic checksum", is that the HIP
>checksum? (nowhere is this referred to as a "cryptographic checksum")
>Does this mean we need an ENCRYPTED TLV in the NOTIFY?

There hasn't been much response about this unknown/cryptic text, so instead, how about:

INVALID_SYNTAX                                     7

         Indicates that the HIP message received was invalid because
         some type, length, or value was out of range or because the
         request was rejected for policy reasons.  To avoid a denial
         of service attack using forged messages, this status may
         only be returned for packets whose HMAC (if present) and
         SIGNATURE have been verified. This status MUST be sent in 
         response to any error not covered by one of the other 
         status types, and should not contain details to avoid
         leaking information to someone probing a node. To aid
         debugging, more detailed error information SHOULD
         be written to a console or log.

-Jeff

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec