TCP-AO extensions for KARP-KMP
This document discusses the possible extensions for TCP Authentication Option (TCP-AO) to better integrate and maximize the benefits, when deployed with Key Management Protocols (KMPs). TCP-AO as defined in RFC5925 can obtain master key from KMP and uses a Key Derivation Function (KDF) to generate traffic keys to protect the TCP sessions. In this mode, not all the benefits from the KMP can be realized. This document introduces an alternative approach for TCP-AO that allows TCP-AO to realize all the operational and security benefits from the deployed KMP.