Subject: [Isis-wg] Re: draft-ietf-isis-hmac-03.txt

From: Radia Perlman - Boston Center for Networking <[email-masked]>
Date: Tue, 23 Apr 2002 19:45:53 -0400 (EDT)

Assuming I'm not misreading the spec, it looks like the assumption is
that there are the following secrets:
  a) an area-wide secret
  b) a link secret, for each link
  c) a domain secret
  
And it looks like Hellos use the link secret, LSPs and SNPs use the
area-wide secret (unless they are level 2 in which case they use the
domain secret).

A few questions:

1) I'd assume that SNPs should use the link secret, since they are
not forwarded

2) I remember IS-IS having a set of acceptable receive secrets,
and a single transmit password, so that secret rollover wouldn't
be a problem. This draft seems to imply there's only a single one.

3) Shouldn't there be a separate layer 1 and layer 2 link secret?
(Again, I think I remember that from DECnet).

Also, it's not traditional for an author to thank himself in
the acknowledgements :-)

Radia

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://spider.juniper.net/mailman/listinfo/isis-wg

---

From: Tony Li <[email-masked]>
Date: Tue, 23 Apr 2002 17:52:53 -0700

| 1) I'd assume that SNPs should use the link secret, since they are
 | not forwarded

Yes, but they can be replicated on multiple links.  This simplifies
implementation.

 | 2) I remember IS-IS having a set of acceptable receive secrets,
 | and a single transmit password, so that secret rollover wouldn't
 | be a problem. This draft seems to imply there's only a single one.

That is certainly an implementation option.

 | 3) Shouldn't there be a separate layer 1 and layer 2 link secret?
 | (Again, I think I remember that from DECnet).

What is gained from this?  [Side question: what is gained from multiple
secrets anyhow?]  I know of no installations where someone would allow an
L1 adjacency but not an L2.  Seems like it could be simplified...

Tony