On Mon, Apr 24, 2017 at 01:47:26PM +0000, Reshad Rahman (rrahman) wrote: > Mahesh, should that be added to draft-ietf-bfd-optimizing-authentication? > > From: Rtg-bfd <[email protected]<mailto:[email protected]>> on > behalf of LuHuang <[email protected]<mailto:[email protected]>> > Reply-To: LuHuang <[email protected]<mailto:[email protected]>> > Date: Monday, April 17, 2017 at 9:19 PM > To: Jeffrey Haas <[email protected]<mailto:[email protected]>>, > "[email protected]<mailto:[email protected]>" > <[email protected]<mailto:[email protected]>> > Cc: Reshad <[email protected]<mailto:[email protected]>>, "Sonal Agarwal > (agarwaso)" <[email protected]<mailto:[email protected]>> > Subject: 回复： Adoption call for draft-sonal-bfd-secure-sequence-numbers > (ending April 30, 2017) > > Yes./ support > > But I think one problem should be considered. If packet loss happens, the > sequence number of received packet won't be the expected number or hash > value, which should be distinguished from malicious packet.
FWIW, I think the procedure will need to be spelled out in one or both of the documents. Generally speaking (as an individual contributor), a mechanism that results in obfuscation of the sequence numbers would require the receiver to pre-calculate the N-next sequence numbers in the obfuscation series. N would be at least the Detection Multiplier number from the BFD session. Upon receiving a sequence number that is obfuscated, the series of N-next would be consulted to see if the sequence number is found. If present in the N-next but not the first, packet loss can be presumed, but still within the Detection Multiplier period. A consequence of this is that if the implementation determines that there had been loss, it must be able to fill the N-next entries in a timely fashion. This could obviously be done on a timer since the numbers are expected to be consumed within a timed environment. But mostly it means that if generating them is event driven the cost of doing so must be considered. This is all arguably an implementation detail, but I think one or both documents will have to cover an example of this for people who don't regularly think about BFD authentication. Similarly, discussion about initial sequence numbers using this obfuscation must also be done. -- Jeff
