Subject: [karp] Mapping of OSPFv2 Key to "Database of Long-Lived Symmetric Cryptographic Keys" (<draft-ietf-karp-crypto-key-table-01.txt>) - Resending with Tim's Email Address Corrected

From: Acee Lindem <[email-masked]>
Date: Thu, 28 Jul 2011 19:12:06 -0400

As promised in yesterday's KARP proposal, I looked at the problem with virtual links in our OSPFv2 manual keying security draft. 
Basically, the problem is that one can have multiple virtual links to the same endpoint router through multiple transit areas. Since a virtual link can take any path through a transit area, the interface key in the database isn't really applicable. 
This may not be a common deployment but I can speak from experience that it is one of the most popular system test scenarios ;^).  

There are three possible resolutions to this problem:

 1. Leave the crypto draft as is and map the virtual link destination router ID to the database peer key and use the database interface key for the virtual link's transit area.
 2. Add a protocol specific identifier key to the database. This could be used for the transit area ID to provide uniqueness. 
 3. Add an explicit area ID key to the database which could be used to provide uniqueness. 

Thanks,
Acee