[IPsec] Re: draft-pan-ipsecme-anti-replay-notification

2024-11-05 Thread Tero Kivinen
Antony Antony writes: > As an extreme example, consider the case where anti-replay protection is > disabled. Suppose the receiver first receives a packet with sequence number > 0x0003 0011. Then, it receives an out-of-order packet with sequence > number 0x FFF0. Although this

[IPsec] Re: draft-pan-ipsecme-anti-replay-notification

2024-11-04 Thread Valery Smyslov
Hi Scott, I just went through this draft, and I think the problem (which is "why do we avoid rekeying after 2^32 packets if replay is not enabled") is actually simpler than what the authors expect. Solution 1: The note about ESN and antireplay is (section 3.3.3) If a receiver

[IPsec] Re: draft-pan-ipsecme-anti-replay-notification

2024-11-03 Thread Valery Smyslov
Hi Antony, > Hi Wei Pan, > > On Sun, Nov 03, 2024 at 03:50:26PM +, Panwei (William) wrote: > > Hi Scott, > > > > Thank you very much for your comments. > > > > What you suggested is actually we proposed in draft v00. In our last > > version, > the notification only contains the status of rep

[IPsec] Re: draft-pan-ipsecme-anti-replay-notification

2024-11-03 Thread Antony Antony
Hi Wei Pan, On Sun, Nov 03, 2024 at 03:50:26PM +, Panwei (William) wrote: > Hi Scott, > > Thank you very much for your comments. > > What you suggested is actually we proposed in draft v00. In our last version, > the notification only contains the status of replay protection, and after > b

[IPsec] Re: draft-pan-ipsecme-anti-replay-notification

2024-11-03 Thread Panwei (William)
Hi Scott, Thank you very much for your comments. What you suggested is actually we proposed in draft v00. In our last version, the notification only contains the status of replay protection, and after both peers exchanged this notification, they can choose not to do the sequence number monitor