F16-RA: Yes

Rationale

The selected two-host upper DIF authenticates remote endpoint-host IPCPs against locally pinned keys. AuthSSH2 fails when the asserted peer has no configured public key. Revocation can use a completed administrative stop and restart: remove the revoked peer key, close affected application flows and stop the old endpoint IPCPs before restoring service with the remaining key set. The normal IPCP destructor removes EFCP connections, RMT forwarding and SDU protection; KFA flow destruction destroys the queued receive SDUs. New sessions must authenticate under the updated key set.

Assessment method

Pinned key admission and administrative endpoint/flow teardown source trace

Source context

IRATI AuthSSH2, normal IPCP destruction and KFA receive queue cleanup

Outstanding qualification

Yes at endpoint-host IPCP identity granularity, using administrative teardown/restart rather than a demonstrated seamless live-revocation command. The completed cutover requires all old affected flow descriptors, in-flight operations and endpoint contexts to be quiesced and destroyed before service resumes; a key-file edit or an isolated destroy-ipcp success message is not itself that boundary. Authorized peers can reconnect with retained keys after restart. Applications must use this protected upper DIF without a parallel unprotected bypass. Application roles, name-to-credential exposure (F21), already delivered data and DoS isolation are separate. Source-supported procedure, not an executed revocation/concurrency test.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.

round676.html