[Cyphal/UDP] Architectural issues caused by the dependency between the node's IP address and its identity

[pavel.kirienko]

@scottdixon

I’m having to think carefully about this. On the one hand, most high-assurance systems require “end-to-end integrity checking” which often leads to every layer in a network stack adding a checksum before handing off to the next layer. This ensures that errors introduced after serialization but before transmission are caught. That said, if you are on an embedded system with lockstep CPUs and ECC RAM the expectation is your program and network stack are inherently robust against data corruption. The one weakness would be if the message was moved into non-ECC hardware buffers before the Ethernet checksum was calculated (e.g. perhaps a stack copies a message into DMA before the Ethernet header is added? Not sure). Perhaps the strategy should be to reserve enough space for such a checksum but not call out the checksum just yet?

The argument for the checksum does sound convincing but I wonder if we could repurpose the Transfer CRC for this. At the moment, the Transfer CRC only applies to multi-frame transfer payloads. Should we explore the possibility of modifying the Transfer CRC such that:

• It is provided for all transfers, not only multi-frame.
• Optionally, it covers the headers of all involved frames as well. This option will complicate its computation though.

The downside of this approach is that the validity of received frames will not be possible to ascertain until the entire transfer is reassembled. Are we aware of any specific failure modes this approach might reveal?

---

If we were to adopt the dedicated header CRC as you described, I presume that we will want to modify the Transfer CRC such that it applies to single-frame transfers regardless, do you agree?