[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Byte-count lifetime enforcement?
Folks,
I mentioned to Steve Kent that using as the byte count the "IP
payload, prior to adding the ESP header and trailer" seems to
imply one particular implementation, and that folks might not be
implementing things that way. The manner that input processing
is implemented might also make it unlikely that the suggested
number would be readily available.
I suspect that a number that would be available in implementations is
the number of bytes fed to the algorithm. (If both ends do not agree
on that number, the packet had better be discarded. :-) Steve agreed
with the reasoning, but pointed out, as has Dan, that the text does
not specify which algorithm should be used for ESP. Dan suggests the
primary algorithm: encryption for ESP, and authentication for AH.
How do folks feel about adding Dan's clarification to the Architecture
document?
(Note that since it is a "SHOULD", there is no reason to delay any
products; those using some other count may change their code when
convenient. As Angelos pointed out, things should be designed to
work no matter which end is the first to exhaust its count.)
Charlie