F16-RI: Yes
Rationale
The selected DTLS profile uses distinct external PSKs for final peers, no tickets and no early data. A local accepted-PSK policy gates establishment. A controlled stop, removal of the revoked peer's PSK and disposal of all live association state can enforce revocation before the service admits traffic again.
Assessment method
Documentary native-policy composition; no cutover or isolation experiment
Source context
HIP policy and ESP teardown; DTLS/TLS external-PSK and closure specifications
Outstanding qualification
The cutover must stop delivery and discard pending handshakes, traffic keys, CID mappings and queued undelivered plaintext, then restart from the updated credential store. Merely deleting the PSK or sending a write-side close_notify does not invalidate every established receive path. This is a native-policy administrative witness, not a default immediate-revocation guarantee or an executed test.
Public sources
- https://www.rfc-editor.org/rfc/rfc9147.html#section-5.10
- https://www.rfc-editor.org/rfc/rfc8446.html#section-6.1
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round268-sources.json