Subject: [Isis-wg] draft-chunduri-isis-extended-sequence-no-tlv-00

From: Manav Bhatia <[email-masked]>
Date: Fri, 28 Oct 2011 01:18:29 +0100 (BST)

Hi,

We had considered adding support for replay protection when doing RFC 5310. The reason it was rejected was because we didnt think such an attack was really possible since (i) the attacker has to be on a direct link and (ii) ISIS is generally run in the service provider "core" router (you dont ever find it as a PE-CE protocol). So, i would first like to understand if something has changed between then and now to prompt a need for such a mechanism.

OSPF is a different beast since OSPF packets can be launched from a site multiple hops away as they ride over IP - and adding mechanisms to prevent OSPF replays becomes significant. I would like to understand the motivation here.

Cheers, Manav

---

From: Uma Chunduri <[email-masked]>
Date: Thu, 27 Oct 2011 22:06:34 -0400

Hello Manav,

First I will have to ask this question:
Do you think service providers ever use keyed authentication (either 5304 or SHA family 5310)? Why?

Uma
________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Manav Bhatia
Sent: Thursday, October 27, 2011 5:18 PM
To: isis
Subject: [Isis-wg] draft-chunduri-isis-extended-sequence-no-tlv-00

Hi,

Cheers, Manav

---

From: Manav Bhatia <[email-masked]>
Date: Fri, 28 Oct 2011 08:08:07 +0100 (BST)

Hi Uma,

Yes, they do. I know providers that use 5304. 

Cheers, Manav

________________________________
From: Uma Chunduri <[email-masked]>
To: Manav Bhatia <[email-masked]>; isis <[email-masked]>
Sent: Friday, 28 October 2011, 7:36
Subject: Re: [Isis-wg] draft-chunduri-isis-extended-sequence-no-tlv-00

Hello Manav,
 
First I will have to ask this question:
Do you think service providers ever use keyed authentication 
(either 5304 or SHA family 5310)? Why?
 
Uma

________________________________
 From: [email-masked] 
[mailto:[email-masked]] On Behalf Of Manav 
Bhatia
Sent: Thursday, October 27, 2011 5:18 PM
To: isis
Subject: [Isis-wg] 
draft-chunduri-isis-extended-sequence-no-tlv-00

Hi,

We had considered adding support for replay protection when doing RFC 5310. 
The reason it was rejected was because we didnt think such an attack was really 
possible since (i) the attacker has to be on a direct link and (ii) ISIS is 
generally run in the service provider "core" router (you dont ever find it as a 
PE-CE protocol). So, i would first like to understand if something has changed 
between then and now to prompt a need for such a mechanism.

OSPF is a different beast since OSPF packets can be launched from a site 
multiple hops away as they ride over IP - and adding mechanisms to prevent OSPF 
replays becomes significant. I would like to understand the motivation 
here.

Cheers, Manav
_______________________________________________
Isis-wg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isis-wg

---

From: Naiming Shen <[email-masked]>
Date: Fri, 28 Oct 2011 14:09:41 -0700

Hi Manav,

I agree with Uma that if operators are concerned enough to put authentication to prevent
hackers to inject their own isis packets, also to the point they are worried the hmac-md5
might not be enough, or even be cracked, then they should definitely worry about replay
since the hackers don't even need to forge their own packets in order to cause disruption.

I did a quick Google search, actually there are many discussions online about the issues
relate to the isis in PE-PC, thus it's probably not as rare as "don't ever find".

Good question on what has been changed for ISIS in recent years. One major thing,
the Data Center, the Cloud.

ISIS packet is no longer as 15 years ago only running over a few tier 1 ISP's backbones,
I'm sure you have been involved in introducing layer2, TRILL, OTV, etc into ISIS protocol.
ISIS is currently running in some of the data centers ALREADY. On the same rack, the switch
which runs ISIS may connect to all kinds of server blades belonging to different admin domains.
If hackers often break into those servers to steal credit card numbers, SSN, files, or
change webpage content to make statements, we probably don't want to insist they have
no way to reach the switches just few inches above their servers, both virtually and
physically.

We have seen how devastating when data center network is hosed. The recent examples
of Amazon's cloud and RIM's network, I'm not saying those are security related cases, but
it's probably not too hard to imagine what can bring some companies down or generate
good WSJ stories these days in today's cyber space.

thanks.
- Naiming