This proposal addresses two major issues in IPsec anti-replay service: 1. Some high end security router can configure thousands of bits for anti-replay window. For example, Juniper can configure up to 4096 bits. The bit-shifting for this window is a tremendous burden, resulting in the performance drop. 2. High-end network processor could have multiple crypto cores to access the window. In order to check and update the window, the exclusive lock must be obtained.
-----Original Message----- From: Tina Tsou [mailto:[email protected]] Sent: Tuesday, May 10, 2011 12:46 PM To: '[email protected]' Cc: 'Xiangyang zhang' Subject: Draft-zhang-ipsecme-anti-replay: IPsec anti-replay algorithm without bit-shifting Hi, Victor and I just submitted https://datatracker.ietf.org/doc/draft-zhang-ipsecme-anti-replay/ IPsec anti-replay algorithm without bit-shifting This document presents a new method to do anti-replay check and update, which becomes one alternative to the anti-replay algorithm in RFC 4302 and RFC4303. The new method will deem the bit-shifting unnecessary. It will reduce the number of times to slide the window. In addition, it makes bit-check and bit-update easier as it does not depend on the low index of the sliding window. It is especially beneficial when the window size is much bigger than 64 bits, for example, 1024 bits. IPsec employs one anti-replay sliding window protocol to secure against an adversary that can insert the messages inside the network tunnel. This method still inherits the sliding window protocol, but use one or more redundant bytes to ease the update of sliding window. The bit-shifting is deemed unnecessary with updating the high and low index of the window, which is especially efficient in case of the big window size. Thus the method reduces the number of times to update the window. In addition, the bit location is fixed for one sequence number, thus makes the bit check easier and faster. Comments are more than welcome. We keep our promises with one another - no matter what! Best Regards, Tina TSOU http://tinatsou.weebly.com/contact.html _______________________________________________ IPsec mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipsec
