Subject: [Hipsec] A possible LSI collision resolution

From: [email-masked] (Julien Laganier)
Date: Mon Mar 1 07:24:00 2004

Folks,

Here are some thoughts about SPI collision:

HIT's are admittedly _statistically_ unique identifiers, and LSI's 
aren't. The reason behind that is that the probability of having a 
collision between two random LSI is 1/2^24, which is quite great 
compared to 1/2^128.

But if one consider the probability of having a collision between any 
permutation of two sets of N randomly chosen LSI's: It is equal (if 
my maths are still good ;-) to (1/2^24)^N = 1/2^24xN. So to have 
about the same probability of collision, you needs N=5.333... 

So if you have two sets of 6 randomly chosen LSI's, the probability 
that the two sets are equal is approximately the same than having a 
collison on two 128 bits HITs.

Here's come the solution: When a legacy IPv4 apps is resolving a DNS 
name into an A resource record, the resolver query HIT and IP 
addresses into a DNS, and then returns the set of 6 randoms LSI to 
the apps.

It will be up to the appplication to try to connect cycling within 
this sets of 6 LSI, the connect possibly failing when LSI collision 
happened.

What do you think? Thank,

--julien