mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 16:24:45 +00:00
After rekey cutover, frames encrypted with the old session can still arrive during the 10s drain window. These carry large sender timestamps from the old session, producing enormous transit deltas that spike the EWMA jitter estimator (observed 2,000-7,000ms spikes on UDP links). Add a time-based grace period (DRAIN_WINDOW_SECS + 5s = 15s) after rekey that suppresses jitter updates until drain-window frames have flushed. Baselines still update every frame so calculation resumes cleanly after grace expires. Fixes #10