Subject: [tsv-area] Re: WGLC for draft-ietf-tsvwg-sctp-auth-03

From: "Shearer, Gavin" <[email-masked]>
Date: Wed, 9 Aug 2006 15:25:59 +0100

As discussed at the recent SCTP Interop event, there is an issue with the
suggested handling of authenticated COOKIE-ECHO chunks.

The draft currently says:

   If the receiver of the packet does not have a TCB when it needs to
   process the AUTH chunk, it MUST ignore the AUTH chunk.  This applies
   to a packet containing an AUTH chunk as a first chunk and an COOKIE-
   ECHO chunk as the second chunk received in the CLOSED state.  If the
   receiver has a TCB, it MUST process the AUTH chunk as described
   above.

This means that as the COOKIE-ECHO is received in the CLOSED state, the
preceding AUTH chunk will be ignored, and so the COOKIE-ECHO will be handled
unauthenticated.

I suggest it should say: The COOKIE-ECHO MUST be authenticated by processing
the COOKIE-ECHO to create a TCB, and then use the secret and random numbers
from the TCB information and the previous AUTH chunk to authenticate the
packet. If authentication fails then the TCB just created MUST be destroyed
and the packet discarded.

Thanks, Gavin