[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: anti-replay notification



>Why can't the sender propose use of AR by the receiver
>(purely as a construct to maintain symmetry) and then the receiver can
>accept or reject that pro forma proposal as a way of signalling whether the
>receiver has enabled AR?

Steve,

If the intent is to communicate the receiver's actual window size back to
the initiator, this wouldn't work because the initiator would have to
know/guess what window size the receiver would want to choose.  In ISAKMP,
the destination only chooses from the initiator's SA proposals.  The
responder does not, himself, propose...

You could offer a set of replay window sizes, in multiples of 32, but this
would expand the SA proposal list multiplicitively by "n", where "n" were
the number of replay window sizes you'd offer.  Even if you were interested
only in knowing whether the responder had selected AR, you'd still expand
the proposals by 2.  It would make more sense to define AR as "different"
and special-case the replay window size attribute on one or both sides.

This additional complexity is, however, why I want to mandate use of
anti-replay for dynamic keying with authentication (AH or ESP-auth).

Derrell


Follow-Ups: References: