Re: Replays - thoughts on Gutmann response

On Tue, 2003-10-07 at 18:36, Sandino Araico Sanchez wrote:
> If we use TCP instead of UDP for key exchange the replay problem can be 
> worked around and there's no performance impact since there's no TCP 
> over TCP encapsulation in key exchange.
> 
> There's lower complexity using UDP exclusively for traffic and TCP 
> exclusively for key exchange since we don't need  to find out if the 
> received UDP package contains a package or a key. When we are sure no 
> UDP package contains a key we just need to check integrity, decrypt the 
> encapsulated package and pass it to the upper layer so the process is 
> simplified.

First, that makes key exchanges easy to find, though I consider that a
minor problem.

The biggest problem is that TCP is much harder to get through a NAT or
firewall than UDP is.

*sigh*,
--
There's an excellent C/C++/Python/Unix/Linux programmer with a wide
range of other experience and system admin skills who needs work.
Namely, me. http://www.omnifarious.org/~hopper/resume.html
-- Eric Hopper <[email protected]>

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA/g5ejjtsvlOwvazYRAuBRAJ9GtBvqCHfvxJHrzLIy1oMYpIBQFQCglUZa
WWUdd2xPtUKB7kiHGCHmSfM=
=4NUQ
-----END PGP MESSAGE-----