Subject: Cookie mechanism -- was -- Re: [Hipsec] Moving the base spec forward

From: [email-masked] (Henderson, Thomas R)
Date: Mon Sep 13 18:44:01 2004

> -----Original Message-----
> From: Yogesh Prem Swami [mailto:[email-masked]]=20
> Sent: Monday, September 13, 2004 12:20 PM
> To: ext Pekka Nikander
> Cc: [email-masked]
> Subject: Cookie mechanism -- was -- Re: [Hipsec] Moving the=20
> base spec forward
>=20
>=20
> 3rd.
>=20
>=20
> ext Pekka Nikander wrote:
>=20
> >=20
> >> *  Optimize for most common case.
> >=20
> >=20
> > You can vary the cookie difficulty.  There is nothing wrong in
> > making K=3D0 by default.
>=20
>=20
> Right, but you still loose a Round Trip.

It is possible in theory (no one has implemented it yet) to
piggyback the TCP SYN and SYN/ACK on the 3rd and 4th packets,
respectively.

---

From: [email-masked] (Pekka Nikander)
Date: Tue Sep 14 06:00:00 2004

>>> making K=0 by default.

Actually, if your implementation can defer tcb creation,
you can carry TCP SYN and SYN/ACK in the first and second
packets, respectively.  The third will then already contain
data traffic.  Hence, in the TCP/SCTP case the situation
can be arranged so that you don't loose any round trips.

For UDP, you have to wait 1 RTT.  You can piggyback data
on I2.

Implementation with the current PF_KEY is pretty tricky,
though.

--Pekka