Subject: [Isis-wg] Cryptographic Algorithm Implementation Requirements for IS-IS

From: Manav Bhatia <[email-masked]>
Date: Sat, 22 Jul 2006 01:39:39 +0000 (GMT)

Hi,
 
This draft follows the ISIS HMAC SHA authentication draft that was presented in Montreal.
 
This document lists down the various authentication schemes and algorithms that IS-IS can use to authenticate its PDUs. Further to ensure interop between different
implementations, it specifies a set of MUST/SHOULD/MAY support auth schemes/algos to ensure that there is atleast 1 auth algo/scheme that all implementations support.

This is basically an equivalent of RFC 4305 for IS-IS. 
 
The nature of cryptography is that new algorithms surface continuously and existing algorithms are continuously attacked. An algorithm believed to be strong today may be demonstrated to be weak tomorrow.  Given this, the choice of mandatory-to-implement algorithm should be conservative so as to minimize the likelihood of it being compromised quickly. 
    
Also, we need to recognize that the mandatory-to-implement algorithm(s) may need to change over time to adapt to the changing world. For this reason, the selection of mandatory-to-implement algorithms should not be included in the base IS-IS specification. This way it is only this document that needs to get updated, whenever there is a need to update the status of mandatory-to-implement authentication algorithms or if some authentication algorithms are deprecated/obsoleted.
 
A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-bhatia-manral-crypto-req-isis-00.txt
 
Thanks,
Manav

> ----- Forwarded Message ----
> From: [email-masked]
> To: [email-masked]
> Sent: Saturday, July 22, 2006 1:20:01 AM
> Subject: I-D ACTION:draft-bhatia-manral-crypto-req-isis-00.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
>    Title        : Cryptographic Algorithm Implementation Requirements for IS-IS 
>    Author(s)    : M. Bhatia, V. Manral
>    Filename    : draft-bhatia-manral-crypto-req-isis-00.txt
>    Pages        : 7
>    Date        : 2006-7-21
>    
> IS-IS currently defines two different kinds of authentication 
> schemes: Clear Text password and HMAC-MD5. There has been recently a 
> new draft submitted that adds support for a generic cryptographic 
> authentication scheme, which can make use of different cryptographic 
> algorithms in order to authenticate the IS-IS PDUs.  
>    
> To ensure interoperability between disparate implementations, it is 
> imperative that we specify a set of mandatory-to-implement algorithms 
> to ensure that there is at least one algorithm that all 
> implementations will have available.   
>    
> This document defines the current set of mandatory-to-implement 
> algorithms to be used for the cryptographic authentication for IS-IS 
> as well as specifying the algorithms that should be implemented 
> because they may be promoted to mandatory at some future time. 
> 
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-bhatia-manral-crypto-req-isis-00.txt
> 
> To remove yourself from the I-D Announcement list, send a message to 
> [email-masked] with the word unsubscribe in the body of the message.  
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
> to change your subscription settings.
> 
> 

_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg

---

From: "Manav Bhatia" <[email-masked]>
Date: Mon, 24 Jul 2006 09:45:18 +0530

Jack,

These definitions have been used in RFCs (4305 and 4307), internet drafts
and the community since quite some time and I don't think there should be
any problem there. In cryptography, algorithms believed to be secure today
may get broken any time tomorrow and we need to continuously deprecate such
algorithms. Thus an algorithm marked as MUST may not always remain a MUST
and it may need to be demoted if there are weaknesses found there.

Hope this helps.

Manav

# -----Original Message-----
# From: Jack Kohn [mailto:[email-masked]] 
# Sent: Saturday, July 22, 2006 11:51 PM
# To: [email-masked]
# Cc: [email-masked]
# Subject: RE: [Isis-wg] Cryptographic Algorithm Implementation 
# Requirements for IS-IS
# 
# Manav,
# 
# Would your definitions of new RFC 2119 language be acceptable to the
# IESG? I personally dont have a huge problem with it, but I'm just
# making sure that flies with the IESG (or the powers to be).
# 
# Jack
# 
# ----- Original Message ----
# From: Manav Bhatia <[email-masked]>
# To: isis <[email-masked]>
# Sent: Saturday, 22 July, 2006 7:09:39 AM
# Subject: [Isis-wg] Cryptographic Algorithm Implementation 
# Requirements for IS-IS
# 
# Hi,
# 
# This draft follows the ISIS HMAC SHA authentication draft that was
# presented in Montreal.
# 
# This document lists down the various authentication schemes and
# algorithms that IS-IS can use to authenticate its PDUs. Further to
# ensure interop between different
# implementations, it specifies a set of MUST/SHOULD/MAY support auth
# schemes/algos to ensure that there is atleast 1 auth algo/scheme that
# all implementations support.
# 
# This is basically an equivalent of RFC 4305 for IS-IS.
# 
# The nature of cryptography is that new algorithms surface continuously
# and existing algorithms are continuously attacked. An algorithm
# believed to be strong today may be demonstrated to be weak tomorrow.
# Given this, the choice of mandatory-to-implement algorithm should be
# conservative so as to minimize the likelihood of it being compromised
# quickly.
# 
# Also, we need to recognize that the mandatory-to-implement
# algorithm(s) may need to change over time to adapt to the changing
# world. For this reason, the selection of mandatory-to-implement
# algorithms should not be included in the base IS-IS specification.
# This way it is only this document that needs to get updated, whenever
# there is a need to update the status of mandatory-to-implement
# authentication algorithms or if some authentication algorithms are
# deprecated/obsoleted.
# 
# A URL for this Internet-Draft is:
# http://www.ietf.org/internet-drafts/draft-bhatia-manral-crypto
-req-isis-00.txt
# 
# Thanks,
# Manav
# 
# > ----- Forwarded Message ----
# > From: [email-masked]
# > To: [email-masked]
# > Sent: Saturday, July 22, 2006 1:20:01 AM
# > Subject: I-D ACTION:draft-bhatia-manral-crypto-req-isis-00.txt

___________________________________________________________ 
To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre. http://uk.security.yahoo.com