Subject: Re: [multipathtcp] RFC6824bis-04 ADD_ADDR2 comments

From: Christoph Paasch <[email-masked]>
Date: Sun, 01 Nov 2015 16:47:02 +0900

Hello Fabrizio,

On 20/10/15 - 09:00:55, Demaria, Fabrizio wrote:
> On the document RFC6824bis-04, where ADD_ADDR2 implementation is specified, there are two points I would like to discuss regarding the following statement:
> 
> "The key used in the HMAC calculation is that of the sender,
> as originally declared in the MP_CAPABLE handshake. The message for
> the HMAC is the Address ID, IP Address, and Port which precede the
> HMAC in the ADD_ADDR2 option."
> 
> This is the indicated procedure to calculate the HMAC to be added in ADD_ADDR2.
> I think it should be specified how to handle the case in which the Port is not present (being optional).

this is a good point. It is currently missing in the spec.
I think it is ok if we set the Port to 0 in the case where it is not set by
the host.

> Moreover, since we have the SHA-1 hash algorithm already implemented for MP_CAPABLE that takes two keys as input, it would be good considering to use both the key of the sender and the one of the receiver for ADD_ADDR2, too. This might ease reuse of code and add some security improvement overall.

I agree. We should use both keys. It has not downsides and will improve the
security.

Christoph

---

From: Olivier Bonaventure <[email-masked]>
Date: Sun, 1 Nov 2015 12:05:38 +0100

Hello,
> I think it is ok if we set the Port to 0 in the case where it is not set by

Agreed

> I agree. We should use both keys. It has not downsides and will improve the

Agreed. We should probably define in rfc6824bis a generic procedure to 
compute all the HMACs (MP_JOIN, ADD_ADDR2) and then apply it each time 
it is necessary

Olivier