

[198.108.1.26])
	by nic.merit.edu (8.9.3/8.9.1) with ESMTP id LAA28965
	for <[email-masked]>; Wed, 17 Jul 2002 11:19:26 -0400
(EDT)
From: "Bruno Rijsman" <[email-masked]>
To: [email-masked]
Subject: Questions about the "Authentication Information" optional parameter
Date: Wed, 17 Jul 2002 11:18:48 -0400
FILETIME=[3FE744D0:01C22DA5]
Sender: [email-masked]
Precedence: bulk

I have some questions about the "Authentication Information" optional 
parameter in the BGP OPEN message.

Have any authentication codes been defined anywhere?

Does any implementation actually support this method of authentication (as 
far as I know everyone uses RFC 2385 which uses a TCP MD5 signature 
instead)?

If it is not used in real life should we remove the "Authentication 
Information" optional parameter from the draft (or at least deprecate it)?

If no "Authentication Information" parameter was exchanged, it seems that 
the 16 marker bytes are a complete waste of space. Would it make sense to 
define a capability (or maybe an authentication code) which means 
"subsequent messages after the OPEN message will not contain the marker 
bytes".
=============================================================

Eric W. Gray
Systems Architect
Celox Networks, Inc.
[email-masked]
508 305 7214

> -----Original Message-----
> From: Yakov Rekhter [mailto:[email-masked]]
> Sent: Thursday, September 26, 2002 12:37 PM
> To: Natale, Jonathan
> Cc: [email-masked]
> Subject: Re: issue 21
> 
> Jonathan,
> 
> > Yes, you are wrong.  Of course there could be a special build that does
> it.
> >
> > I still think the bgp auth. option should be depreciated.
> 
> Please note that the subject of the discussion is issue 21. This issue
> has *nothing to do* with deprecating the bgp auth option - it has
> to do with adding a sentence pointing that one could use rfc2385.
> 
> Yakov.
> 
> >
> > -----Original Message-----
> > From: Kunihiro Ishiguro [mailto:[email-masked]]
> > Sent: Thursday, September 26, 2002 12:29 PM
> > To: Natale, Jonathan
> > Cc: 'Yakov Rekhter'; [email-masked]
> > Subject: Re: issue 21
> >
> > >Issue 21's main point is mentioning MD5 authentication along with BGP
> > >own password auth.  I agree with it and current text is enough for the
> > >purpose.  I know people actually uses BGP own auth (just a few though)
> > >so I hesitate to say that deprecating BGP own auth.
> >
> > I may be wrong.  I was told that Cisco does Open Message parameter's
> > optional simple password auth by 'neighbor password 7 LINE' but it
> > does not.  Jeff, how about GateD?
> >
> > My opinion about this issue is keep current text then investigate
> > current best practice.
> > --
> > Kunihiro Ishiguro