[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Granularity of authentication in swIPe
Phil,
The motivation you cite for using an IV/sequence number was
the major reason I was not enamored of the proposal originally. In
some contexts per-packet IVs might have to be random or have some
other structure that would make for poor sequence numbers. I think it
would be better to keep the two concepts separate. My motivation for
the sequence numbers is more denial-of-service oriented, although
a side effect is to counter attacks with other possible goals.
As for managing the sequence numbers, you're right that it may
not be easy to do it efficiently given occasional out-of-order
arrivals. But, as you observed, most packets do arrive in sequence,
so you might just keep track of the last sequentially validated
sequence number, plus a small bit map or sorted list of sequence
numbers to track packets in a region where there are gaps. By
negotiating the size of the window at association establishment time,
the receiver bounds the size of the bit map or list.
Steve
References: