Subject: RE: [Hipsec] changes to base spec?

From: "Henderson, Thomas R" <[email-masked]>
Date: Tue, 21 Jun 2005 18:26:25 -0700

I reviewed Petri's recent draft with an eye towards making changes to
align with the proposals in the Aura et al. paper that we discussed last
month, but found that Petri had already made most of them.  I still
suggest a few changes below and have sent the diffs directly to Petri.

Tom

** Proposal 1:  Add nonce to I1 and to unsigned part of R1 

Action:  No list consensus on adding this.

** Proposal 2:  Hash nonces I and J into key material

Action:  Petri already made the change to Section 6.4 

** Proposal 3/4/5:   Changes to secure the cookie mechanism

Action: Petri already updated the Appendix C to correspond to the 
stronger cookie selection mechanism.

However, there is leftover from the past some guidance in 4.1.1 
(and also in the appendix itself) to explicitly recommend against using 
the algorithm in Appendix C.  I don't think that the guidance
applies anymore-- I think that we would be fine if people implement
Appendix C now, with the changes proposed.

Also, there is still guidance in the Appendix to allow Responder to
keep state about failed puzzles.  I replaced that with the
following:
"The Responder SHOULD NOT keep state about failed puzzle solutions."

Specific diffs provided to Petri.

** Proposal 6:  Do not encrypt Initiator HI in I2

Action:   Petri already made this a MAY (Section 5.3.3)

** Proposal 7a:  Move from R2-SENT to Unassociated upon timeout

Action:  Per discussion on list, do not move to Unassociated upon
timeout,
         but only after "Unused Association Lifetime" has been exceeded
         Define "Unused Association Lifetime" in the Definitions
section.

Specific text change in R2-SENT state:
From:
"If no data is received during an implementation specific time,
   move to UNASSOCIATED"
To:
"No packet sent/received during UAL minutes, send CLOSE and go to
     CLOSING."

** Proposal 7b, 7c, and 8:  Tiebreaker rules for handshake packet
collisions

Action:  Petri seems to already have made these changes.

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec