Subject: RE: [Hipsec] keymat / state machine problem with packet retransmission

From: Miika Komu <[email-masked]>
Date: Wed, 3 Aug 2005 12:45:31 +0300 (EEST)

On Fri, 29 Jul 2005, Ahrenholz, Jeffrey M wrote:

You are right, sorry for the extra fuzz. Thanks also for Jan and Julien
for their offline comments. If there were issues created for the i/j and
spi problems, they can be safely removed.

> I don't know if this is a problem -- upon receiving the second R1, you
> can compare the R1 generation counter and decide that it is not greater
> than before, and drop the packet. Also, R1s are not retransmitted, so
> this "reflection" would have to be some effect of the network.
> Alternatively, if you receive the same R1 and you're in I2_SENT, it
> seems like you can retransmit your same I2 again, containing the same
> solution.
>
> As your example B shows, it seems like your retransmitted I2s have different solutions. I would think that the retransmitted I2 is just a copy of the previous packet.
>
> -Jeff
>
> > -----Original Message-----
> > From: Miika Komu [mailto:[email-masked]]
> > Sent: Friday, July 29, 2005 6:22 AM
> > To: [email-masked]
> > Subject: Re: [Hipsec] keymat / state machine problem with
> > packet retransmission
> >
> >
> > On Fri, 29 Jul 2005, Miika Komu wrote:
> >
> > > I discovered a problem in the state machine that may be
> > worthy of noting
> > > the draft. I discovered a hint for the problem during
> > interops, and later
> > > I could confirm it by running base exchange with the HIPL
> > implementation
> > > so that each HIP control packet sent was repeated always N x times.
> >
> > Let me elaborate more with two examples:
> >
> > Example A: C and D happen simultaneously:
> >
> > a) ---->  I1
> > b) <----  R1
> > c) -----> I2
> > d) <----  R1  reflection of R1 (exactly the same as in b): initiator
> >               processes again!
> > e) ------> I2 the cookie solution must be same as in c, otherwise
> >               end-up with mismatching keymat
> > e) <---- R2
> >
> > Example B: d and e happen simultaneously:
> >
> >   init   resp
> >
> > a) ----> I1
> > b) <---- R1
> > c) -----> I2
> > d) <---- R2
> > e) -----> I2 the cookie solution must be same as c, otherwise
> >              end-up with mismatching keymat
> >
> > Unless my thinking is incorrect, some text should be added that the
> > initiator must remember the cookie solution it sent in I2 (and not to
> > calculate a new one) upon retransmissions. The same applies
> > for the SPI
> > value.
> >
> > --
> > Miika Komu              [email-masked]          http://www.iki.fi/miika/
> >
> > _______________________________________________
> > Hipsec mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/hipsec
> >
>

-- 
Miika Komu              [email-masked]          http://www.iki.fi/miika/

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec