Subject: [Isis-wg] Optional Checksum in ISIS

From: Derek Yeung <[email-masked]>
Date: Mon, 14 May 2001 19:37:48 -0700

Hi,
	What's the status of draft-ietf-isis-wg-snp-checksum-01.txt ?
	The copy I have expired Oct 2000 and I cannot find a newer version on the IETF web.

Thanks,
- Derek
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Tony Przygienda <[email-masked]>
Date: Tue, 15 May 2001 23:06:39 -0700

Derek Yeung wrote:

> ________________________________

passed last call and was forwarded to ADs a nice while ago with couple other drafts.
There was some serious feet-dragging there and change of ADs just happened
as well. I hope to see the RFC out anytime soon ...

If you need the draft, I'm sure enough private copies swirl around. Less than ideal, I know.

    thanks

    -- tony

---

From: Derek Yeung <[email-masked]>
Date: Wed, 16 May 2001 16:03:40 -0700

> If you need the draft, I'm sure enough private copies swirl around. Less than ideal, I know.

	Any big change between the 01 draft and the final RFC ? If there is no important
change, my copy would be good enough.

	BTW, I have a few questions about the 01 draft.

	The draft said one cannot rely on authentication as checksum mechanism. 
Does the draft refer to simple cleartext authentication in particular or any authentication
scheme ? IMHO, MD5 authentication alone should be able to detect packet corruption. For example, 
in OSPF, checksum is not calculated when MD5 authentication is used. The only problem 
I see is that one cannot tell whether error is due to packet corruption or
real authentication failure, but it is probably not a big deal.

	The draft also said that an implemenation that implements optional checksum MUST
accept PDUs which do not contain optional checksum. Given that a checksumed PDU could
be corrupted in a way that it appear to contain no optional checksum. Then wouldn't the rule 
permit corrupted packet to go undetected and defeat the purpose to do checksum in the first place ?

Thanks,
- Derek

---

From: Tony Przygienda <[email-masked]>
Date: Wed, 16 May 2001 17:17:26 -0700

> change, my copy would be good enough.

don't remember what 01 was but the only change that pretty much ever came up was the issue
of whehter you calculate csum first or authentication. Nischal caught that when implementing.

> real authentication failure, but it is probably not a big deal.

well, source authentication should imply integrity in security so it's kind of true what you're
saying.
However, this clear text password is a glaring hole here (it's basically not authentication ;-)
So having said that, we could add a sentence or so to the draft saying that if it's clear that
authentication verifies integrity of the packet, checksum can be omitted. Read on ...

> permit corrupted packet to go undetected and defeat the purpose to do checksum in the first place ?

very brain-twisted but to a certain extent you're right. However, IMHO it's kind of much more
important to not
make the assumption that someone MUST put optional checksums on packets (equivalent to
saying that you MUST NOT or MAY only accept packets without optional checksums). That
would render piles of existing deployment problematic and lead to nasty effects when
boxes are misconfigured. Also, that would introduce even more dependencies with the previous point
you brought up since  you'd have to say
e.g. "must accept pdus which do not contain optional checksum if md5 is present". then of course
think about the case where the checksum tlv got corrupted so it's not present anymore AND
md5 got corrupted to deliver correct verification for that corrupted packet. Worst of all I think
saying that "you must not accept packets without optional checksum when you expect it" would
prevent in future boxes from being shipped with optional checksums enabled as default which I'd like
to see ideally. All that doesn't end and has a 0.00001% of a chance
to show up in real networks ;-)

To summarize, I'd like to keep MD5 and checksums decoupled for simplicity reasons
and only resolve the dependency which
one's to be computed/verified first when received so I'd resist either change you brought up.

    - -tony

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 16 May 2001 20:04:09 -0400

At 19:03 16/05/01, Derek Yeung wrote:
>IMHO, MD5 authentication alone should be able to detect packet corruption. For example, in OSPF, checksum is not calculated 
>when MD5 authentication is used. 

Quite right on both counts.

>The only problem I see is that one cannot tell whether error 
>is due to packet corruption or real authentication failure, 
>but it is probably not a big deal.

Agree.

Ran

---

From: Derek Yeung <[email-masked]>
Date: Thu, 17 May 2001 22:46:58 -0700

> very brain-twisted but to a certain extent you're right. However, IMHO it's kind of much more

	Not brain-twisted at all, I found it pretty obvious ;-)

> to show up in real networks ;-)

	IHMO, "you must not accept packets without optional checksum when you expect it" is the
right thing to do. Just a different opinion, no big deal.

> one's to be computed/verified first when received so I'd resist either change you brought up.

	I am not proposing to couple MD5 and checksum in the same draft. My point is just that
if MD5 authentication has been implemented already, there is no significant technical reason 
to implement optional checksum too.

Thanks,
- Derek

---

From: Tony Przygienda <[email-masked]>
Date: Fri, 18 May 2001 22:39:57 -0700

>         Not brain-twisted at all, I found it pretty obvious ;-)

ok

> right thing to do. Just a different opinion, no big deal.

ok, agreed to disagree here .... maybe more people will comment.

>         I am not proposing to couple MD5 and checksum in the same draft.

well, if we start to put in the draft all kind of sentences as of what to do conditionally if either
MD5 is present or not, we'll end up coupling those issues together.

> My point is just that

agree technically, observe that
with the way the draft is stated you are free to ignore CSUMs if MD5 is configured and omit them
in your packets. Things will still work. So in a sense there is no need to specifically state that you
HAVE TO omit them.

    thanks

    -=-= tony

---

From: Russ White <[email-masked]>
Date: Sun, 20 May 2001 19:49:48 -0400 (EDT)

> > My point is just that if MD5 authentication has been
> > implemented already, there is no significant technical reason
> agree technically, observe that with the way the draft is
> stated you are free to ignore CSUMs if MD5 is configured and
> omit them in your packets. Things will still work. So in a
> sense there is no need to specifically state that you HAVE TO
> omit them.

I'll agree with Tony here, and say we should leave it
optional. Of course, I'd expect implementations to ignore the
checksum if md5 is enabled, just as a matter of efficiency. It
won't matter if anyone actually sends them if everyone ignores
them when md5 is enabled, so we'll all end up not sending them
either, most likely.

:-)

Russ

_____________
[email-masked]