Re[2]: Bellovin's and Ahar's attacks

["Housley, Russ" <housley@spyrus.com>]

Dan:

>>  1. If the IPSEC processing is happening within the destination system,
>>      then it should rekey every time a socket is closed.  This ensures that 
>>      any subsequent user of the same port will get a different key.
>
> IPSEC processing will happen both on the source and destination systems.
> The destination can't rekey unilaterally, since the source would still be
> using the old key. So there has to be synchronization between the source
> and destination when rekeying occurs. Its been known for a long time that
> TCP connections could support rekeying when they open a connection.
> However, UDP doesn't support the notion of a connection, so rekeying UDP
> end-points requires some external synchronization.

This is why IEEE 802.10c includes the DELETE-SA service.  One system can tell 
the other that it is finished with the key....

Russ

---

• Prev by Date: Re: Bellovin's and Ahar's attacks
• Next by Date: Re: Bellovin's and Ashar's attacks
• Next by thread: Re: IPv6 Security Last Call Initial Questions
• Index(es):
  • Main
  • Thread