laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-10-05 11:08:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Document that disabling rekey is unsupported and removed in v2

Browse Source 
The configuration reference and the mesh-layer design presented
node.rekey.enabled: false as an ordinary setting. It is a less-tested
path the project does not support, and the option goes away in v2. The
flag's behaviour is unchanged.
This commit is contained in:
Johnathan Corgan
2026-09-30 13:46:23 +00:00
parent 957f042282
commit 0277a72b79
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/design/fips-mesh-layer.md
+3 -2
View File
@@ -374,8 +374,9 @@ A rekey is initiated when either threshold is reached on the link's current
session: `node.rekey.after_secs` (default 120) elapsed since the link came
up or last rekeyed, or `node.rekey.after_messages` (default 65536) frames
sent. Either side can be the initiator independently. Rekey is on by
default and can be disabled via `node.rekey.enabled: false` (the
configuration tree is documented in
default. `node.rekey.enabled: false` stops this node initiating rekey, but
that configuration is unsupported: it is a less-tested path, and the option
is removed in v2 (the configuration tree is documented in
[../reference/configuration.md](../reference/configuration.md)).
### Mechanism
docs/reference/configuration.md
+2 -1
View File
@@ -378,7 +378,7 @@ cutover.
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| `node.rekey.enabled` | bool | `true` | Initiate periodic Noise rekey on links and sessions. A peer-driven session rekey is still answered when this is off, so session keys can still rotate |
| `node.rekey.enabled` | bool | `true` | Initiate periodic Noise rekey on links and sessions. A peer-driven session rekey is still answered when this is off, so session keys can still rotate. Disabling rekey is unsupported: it runs the node on a less-tested path, and the option is removed in v2. |
| `node.rekey.after_secs` | u64 | `120` | Initiate rekey after this many seconds on a session |
| `node.rekey.after_messages` | u64 | `65536` | Initiate rekey after this many messages sent on a session |
@@ -1167,6 +1167,7 @@ node:
loss_threshold: 0.05 # MMP loss rate threshold for CE marking (5%)
etx_threshold: 3.0 # MMP ETX threshold for CE marking
rekey:
# enabled: false is unsupported, less tested, and removed in v2
enabled: true # periodic Noise rekey for forward secrecy
after_secs: 120 # rekey interval (seconds)
after_messages: 65536 # rekey after N messages sent