Dear Authors,
I've got a question on how the proposed mechanism to use Authentication only
for the state transition signaling affects the state machine. Consider BFD
implementation that uses HW-assistance. BFD control packets with NUL Auth TLV
can easily be validated in the HW but those that have real Authentication may
require a punt and processing out of the fast path. Authenticated packet to be
validated must pass authentication verification and that may happen much later.
If we imagine, though it is a stretch, that the next two packets get lost or
corrupted, then we may have false negative because validation of the
authenticated packet is outside of the normal validation path.
Or consider another scenario when validation fails because of the
Authentication. Should this have immediate impact on the state machine? If not,
the new state will be learnt from the very next BFD control packet, which is
not authenticated as I understand the proposal. Then what is the benefit of
sending state change with Authentication?
Regards,
Greg
