Documentation/networking/tcp_ao.rst

34  |TCP connection        |                        |                       |
68    >> The IDs of MKTs MUST NOT overlap where their TCP connection
71 Q: Can Master Key Tuple (MKT) for an active connection be removed?
75    It is presumed that an MKT affecting a particular connection cannot
76    be destroyed during an active connection -- or, equivalently, that
77    its parameters are copied to an area local to the connection (i.e.,
81 to not remove it for an active connection? (As it can be still in use
109 may yet not have the new key - the TCP connection may just break.
112 Q: What happens when a packet is received on a new connection with no known
119    connection. Find the matching MKT for this segment, using the segment's
120    socket pair and its TCP-AO KeyID, matched against the MKT's TCP connection
134    connections, or the connection can indicate that TCP-AO is required.
154    TCP connection identifiers.
157 the connection be reset?
189 Q: If both peers have multiple MKTs matching the connection's socket pair
205 Q: Can TCP-MD5 connection migrate to TCP-AO (and vice-versa):
210    does not support any changes to a connection’s security algorithm
213 Q: If all MKTs are removed on a connection, can it become a non-TCP-AO signed
214 connection?
218 While switching to non-TCP-AO connection is not prohibited directly, it seems
231    One or more MKTs. These are the MKTs that match this connection’s
234 Q: Can a non-TCP-AO connection become a TCP-AO-enabled one?
236 A: No: for an already established non-TCP-AO connection it would be impossible
239 re-establishing the TCP connection.
296 It is not allowed to add a key on an established non-TCP-AO connection
297 as well as to remove the last key from TCP-AO connection.
306 the TCP-AO connection.
352    TCP connection identifier. A TCP socket pair, i.e., a local IP
364 In contrast with an established TCP-MD5 connection which has just one key,
385 happened on the listen socket is reflected on the newly established connection.
392 during the 3-way handshake for the new TCP connection.
397 A TCP connection can not migrate between TCP-AO and TCP-MD5 options. The