[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: A pothole in ISAKMP/Oakley
The basic problem was noted in January, and the fragility of the use
of the SPI was also noted then. My preference is to include a state
variable with SKEYID that is an instance number; the state variable
gets incremented every time keying material is generated, and the
keying material depends on the variable.
I will note, however, that if the SPI's are pseudo-randomly generated,
as is required by the spec, then the probability of using the same SPI
twice should be extremely low. So the implementations that revealed
this problem were defective.
Hilarie
Follow-Ups: