[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Heartbeats Straw Poll
> Maybe we need a "death certificate" CA :-)
Heh. Actually, one of the ideas I'm kicking around:
If we have the system sign a "birth certificate" when it reboots
(including a reboot time or boot sequence number), we could include
that with a "bad spi" ICMP error and in the negotiation of the IKE SA.
This pushes the burden of reestablishing state to the end which
already thinks it has shared state and has traffic it wants to send.
The system which is receiving packets to unknown spi's merely has to
respond with a simple message which involves no real-time cryptography
(it should, of course, be rate limited).
The system receiving the error message can discard it if it doesn't
correspond to existing state or if it's "old news" (i.e., you get
replay protection); if it's not old news, you can rate-limit how often
you attempt to verify the signature.
I *think* this is relatively resistant to replay and DoS...
- Bill
Follow-Ups:
References: