[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Re[2]: Granularity of authentication in swIPe
>On one hand, you say that you want to keep the SAID small. You suggest 16
>bits. On the other hand, you want add sequence numbers for a faciltiy
>which you claim is not "bulletproof."
The SAID is an especially sensitive issue with me since it has to be
in every packet. On the other hand, the use of sequence numbers could
be negotiated on a per-SAID basis, which makes them less objectionable
-- you can turn them off if you want.
My sequence numbers are currently only 16 bits. The idea is that you'd
probably rekey before this wraps around (assuming a dynamic key management
protocol).
I am not trying to solve every conceivable problem with IPSP. That's
how things like OSI come about. The Internet approach has always been
to try first to solve 95% of the problems with only 5% of the
effort. Then after we get some real world experience we can decide if
the remaining 5% are worth solving, or whether they are even real or
not.
Phil
Follow-Ups:
References: