Skip to content

protocol-limitations.md

Latest commit

 

History

History
14 lines (13 loc) · 3.28 KB

protocol-limitations.md

File metadata and controls

14 lines (13 loc) · 3.28 KB
Raw

Protocol limitations

  • Not a VPN: only an opt-in PSK IKE session API, one host-to-host ESP CHILD_SA and a single-peer UDP negotiation command; no credential store, real PQ providers, QKD or daemon.
  • Experimental externally provisioned HKDF keys are not an IKE or hybrid protocol; caller authenticates context and ensures freshness. Restoring old provisioning context can repeat GCM keys/nonces.
  • ESP primitive only: AES-256-GCM-16, no ESN, NAT-T, general selector ranges, IPv6 gateway, TUN/TAP, fragmentation/reassembly, PMTU, IPComp, AH or ChaCha20-Poly1305.
  • IKE parsing is structural, capped and intentionally incomplete. Parsing CERT/AUTH/KE is not cryptographic verification. The session profile adds SPI/message-ID correlation and cryptographic verification for IKE_SA_INIT/IKE_AUTH and one initiator-created CREATE_CHILD_SA exchange. It accepts one exact algorithm proposal, ID_KEY_ID and PSK; additional payload combinations, cookies, EAP, certificates, INFORMATIONAL, rekey and fragmentation are unsupported.
  • Childless operation requires the experimental RFC 6023 capability. No interoperability with an independent IKE daemon is claimed. The optional UDP runner pins one endpoint and bounds retries, datagrams and elapsed time. It has no multi-peer admission control, cookies or NAT-T; UDP/4500 is rejected. Direct session API users must route messages, schedule retries and call expire periodically. Lifetime is absolute (maximum one hour), including negotiation; expiry never restarts. Unsupported or invalid messages return local errors rather than on-wire error notifications.
  • ike-handshake is a finite authentication probe; it closes the session before exiting. It can negotiate a CHILD_SA but does not retain a tunnel or update status. Library UDP success returns the authenticated session and socket, with an absolute session lifetime of twice the configured handshake timeout plus one second. A responder remains available for one timeout interval after authentication to answer final retransmissions; it cannot prove its last response was delivered.
  • CHILD_SA support is one atomic pair, tunnel mode, AES-256-GCM-16, non-ESN, exact IPv4 inner hosts and all upper-layer protocols/ports. No selector narrowing, additional DH, transport mode, child rekey, deletion or multiple children. IPv4 options/fragments are rejected. The pair is private to the session, and closes/expires with it; it is not installed into the OS or global SAD. ESP packet APIs do not route or transmit packets.
  • SA generation replacement is local ownership/lifecycle behavior, not an interoperable peer rekey protocol. Inbound retirement grace is bounded only by original lifetime or explicit retirement.
  • SAD tombstones bound lifetime admissions, not just concurrent SAs. Once full, admission fails until a fresh runtime with fresh authenticated context; no automatic unsafe tombstone eviction.
  • std is required. Memory locking, swap/core-dump hardening and a split no_std core are not implemented.
  • Zeroization does not prove all compiler copies or dependency-internal HKDF/HMAC state are erased. Supply-chain, side-channel and independent security audits remain required.
  • Tests and short fuzz/benchmark runs are regression evidence, not proof of protocol security or production performance. No full RFC/ETSI conformance or FIPS validation claim.