Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:16:21 ADT
Matt Blaze (mab@crypto.com)
Fri, 27 Mar 1998 14:26:25 -0500
Bill Stewart writes:
>Realistically, you probably don't want more than 1 byte payloads,
>which takes 256 MACs per byte. In general, an n-bit payload
>takes 2**n MACs, averaging half that, vs 2*n**1 for n 1-bit payloads.
>Using it for a 64-byte packet would be infeasible, much less
>for a 576-byte or 1536-byte MTU. TCP/IP header compression can let you
>get down to ~ 3 bytes of header per packet, so you could conceivably
>run an IPSEC-authenticated telnet session with 4-byte payloads
>(1 typed character plus header), but that takes 4 billion MACs per keystroke,
>which would be a mite slow; you'd be far better off creating a large
>number of these sessions and using the MAC key to carry the data
>while sending cover traffic in the wheat/chaff.
>
I was using "payload " to refer not to the payload field of the IP
packet, but to the real data, minus any headers. In the case of
TCP, of course, you'd want the "delete" prgram to wipe out the
data plus checksum, and the regenerate program to reinsert only
2^{|data|} messages, each with its correct checksum( which
is harmless since the authentication header is providing the "real"
checksum). So even with tcp, you should be able to fiddle with the MTU
to get 1-byte effective payloads.
-matt
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:16:21 ADT