[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Increased sequence number in ESP/AH
Dan Harkins wrote:
>Of course. The single 32-bit add is noise. But keeping that counter in
>sync is not.
How about the following alternate proposal? Does it satisfy your needs?
The suggestion is to have receivers be more sophisticated about managing
their replay windows. Rather than keeping a single, 32-bit window for
32 consecutive sequence numbers, how about keeping N independent
(appropriately spaced out) replay windows, where N counts the degree of
parallelism you want at the sender?
What I like about this approach is that it doesn't introduce any risk
of replay attacks. And, since the original proposal (make replay detection
optional & negotiable) already requires changed to both endpoints, this
approach is not really any worse in that respect.
But I probably didn't quite understand your requirements. Will this work?
Follow-Ups:
References: