[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bellovin's and Ashar's attacks
Dan Nessett says:
> > It can't. You decrypt it first and then pass it along with information
> > to the transport that indicates what the transform that had been used
> > for the encapsulation was before you unencapsulated the packet.
>
> This seems to confirm my original point that the IP layer will have to
> continually rekey in order to process arriving packets.
In my implementation, I have a key schedule associated with every SA
structure, so I'm "rekeying" in the sense of using different keys for
every packet, but you have to do this no matter what even in host to
host keying.
.pm