Re: [radext] RDTLS #65 (new): Multiple dtls sessions in a tuple?

[Alan DeKok <aland@deployingradius.com>]

Peter Deacon wrote:
> Isn't this what client hello /w cookies and the secure handshakes are
> for? Surely these can't be spoofed so easily?!

  This is assuming you get that far.  My assumption is that maintaining
multiple DTLS sessions for the same {src ip/port dst ip/port}
combination is a bad idea.  I do not know the security implications of
doing it, and I don't think I'm enough of a TLS expert to say.

> What if the session does not exist anymore and the client tries to
> reestablish or it is behind a NAT and there is unlucky synchronization
> of source ports?

  The client can retry.  The server can discard unused sessions.

  It's imperfect.

> You can have both by broadcasting the datagram to both sessions which is
> why I'm asking what the expected behavior in this instance should be.

  I am *very* wary of doing that.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>