Subject: RE: [Isis-wg] Re: draft-ietf-isis-hmac-03.txt

From: Jeff Parker <[email-masked]>
Date: Wed, 24 Apr 2002 10:24:26 -0400

> > 1) I'd assume that SNPs should use the link secret, since they are
> > not forwarded
> >
> > Radia
> 
> SNPs use area/domain passwords as specified in ISO 10589 7.3.15.3a.
> (and other places)
> 
> Les

Les -
	That is the standard, but Radia has an interesting point.  
	Doesn't the use of an area secret allow some replay attacks?  

- jeff parker
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://spider.juniper.net/mailman/listinfo/isis-wg

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 24 Apr 2002 11:26:44 -0400

> 	Doesn't the use of an area secret allow some replay attacks?

The objective is to document what ISPs have already widely deployed,
not invent something new.  The other thing to keep in mind is that
the ISPs merely want to have protection from eavesdropping on cleartext
IS-IS passwords.  The deployed approach totally solves that problem.

Note also that when I proposed something different than what is deployed,
there was overwhelming push-back from operators saying the above.

This thing was *deployed* several years ago.  We just need to document
what has been deployed in an Informational RFC.

If folks want to do something different, then that should be
a separate activity in a separate document and should NOT
delay publication of the deployed mechanism.

Ran
[email-masked]