Subject: RE: [Isis-wg] RE: draft-ietf-isis-hmac-03.txt

From: Jeff Parker <[email-masked]>
Date: Mon, 7 Apr 2003 14:15:09 -0400

> How far did this draft go  ? There are some issues that stood 
> to evolve since then :

While the expiration date on the draft is in the past, I think 
this document is very much alive.  
> 
>  "This  mechanism  does  not  prevent replay attacks, however such
>  attacks would trigger existing mechanisms in the IS-IS 
>  protocol  that would  effectively reject old information.  
>  Denial of service attacks are not generally preventable 
> in a useful networking protocol [4]."
> 
> 
> While I agree tht the HMAC-MD-5 will not stop replay 
> attacks alone but when used in conjuction with the 
> protocol will work with the timers and other
> mechanism to render the attack useless.
> 
> My exception is with what clearly seems to be opinion  " 
> Denial of service attacks are not generally preventable 
> in a useful networking protocol"
> 
> Before "getting bent out of shape" I realize that there
> is always a chance of mis-communication would like a 
> full and clearer explanation. The other expanation is 
> that this rfc and the writer's opinion has indeed evolved.
> Will

Will -
	First, this proposal is a real advance over prior art.
It was much worse before this. 
	As to the statement above, it -is- quite difficult to 
have a useful routing protocol that doesn't involve trusting
the information provided by a third party.  
	If you are open to peering with new neighbors, as
any IGP with a hello protocol is, you are subject to 
DOS attackts.   
	If you compromise a router in the network, you 
can inject false information into the network, and thus
misroute and blackhole traffic, and waste router cycles
with spurious SPF recomputations.  
	There are things that you can do to mitigate these 
effects, but it isn't clear that outlining this is within 
the scope of this group. While the language above is blunt, 
those are the realities.  

- jeff parker
_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg