mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-06 11:38:24 +00:00
Johnathan Corgan
d95fc708e0
The drain deadline for the `previous` slot slides forward on every inbound frame that authenticates against it. That is deliberate: it stops the old epoch being erased out from under a peer that lost msg3 and is still sealing in it. But the only party that can push the deadline out is the authenticated peer holding that key, so a peer that keeps using the old epoch keeps the retired key resident indefinitely. Add an absolute ceiling measured from the cutover, so the sliding grace delays erasure by a bounded amount rather than preventing it. The ceiling has to clear the worst-case legitimate recovery of a peer that lost msg3, which is the msg3 resend ladder plus the responder's handshake timeout plus the rekey dampening window, about 90 seconds at stock settings. It defaults to 120 seconds and is raised to the budget the configured handshake timers actually imply, so tightening a timer cannot push the ceiling under the recovery it has to leave room for. This does not close the related gap where an FSP rekey we initiate and the peer never answers is never abandoned, which leaves the session's current epoch pinned and not rotating. The cap erases the old epoch on schedule regardless, which is a strict improvement, but a session read afterwards can show no drain alongside a stale current key for that reason rather than because of this change.