[e2e] Receiving RST on a MD5 TCP connection.

[Mitesh Dalal]

On Fri, 1 Jul 2005, Joe Touch wrote:

>
>
> Mitesh Dalal wrote:
> ...
> >>Another point along these lines - if you had a secure connection with
> >>another host, then the host reboots and 'forgets' the security
> >>altogether (i.e., doesn't reestablish keys), it shouldn't be able to
> >>reset the old connection anyway.
> >
> > and why would that be Joe ? By saying so you have no love for network
> > reliability. Do you know networks can go down if MD5 enabled LDP
> > connection cannot recover from this problem and rely on timeouts
> > to recover ? Do you know the same thing can happen to BGP ?
> > Security shouldnt come at the cost of reliablity!
>
> New keys should - as I noted later in my post - flush state associated
> with old keys. Lacking new keys, old state does no harm, since new
> connections shouldn't occur.
>

what we are discussing is how fast can we detect a stale connections
to a rebooted host. New keys come into picture only if the host is up.
For TCP MD5 scenarios we dont change keys ever.

> Recovering from a problem doesn't mean leaving your doors unlocked.

yes, so lets use a combination lock, the owner does not have to carry
a key around (and potentially loose it) and instead simply remember
the right combination (hint:tcpsecure) to gain access :)

Mitesh