Subject: [karp] BFD authentication documents of interest to KARP

From: Jeffrey Haas <[email-masked]>
Date: Wed, 27 Jul 2011 18:45:00 +0000

As per the IETF 81 KARP session, Manav has a document that is intended to address
some of the security gap issues for BFD:

http://tools.ietf.org/html/draft-bhatia-bfd-crypto-auth-03

This document should be adopted as a WG item in BFD once our charter clears
IESG.  Please note that the authors were requested to split the document
into two components:
1. The SHA-2 procedures
2. The generic keying mechanism.

Please examine these documents for coverage of issues found in the KARP
reviews.  If there are additional gaps, consider if they are appropriate to
include in the above documents or require a new document in BFD.

-- Jeff (speaking as chair)

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 27 Jul 2011 11:56:15 -0700

I see a general need for key management for all routing/signaling
protocols that are either connection oriented or connectionless. Would
it make sense to combine efforts? I know that Vero presented a LDP
Hello draft today that is based on UDP. Could that be extended to
cover all of UDP based protocols and BFD?

On Jul 27, 2011, at 11:39 AM, Jeffrey Haas <[email-masked]> wrote:

> _______________________________________________
> karp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/karp

---

From: Vishwas Manral <[email-masked]>
Date: Wed, 27 Jul 2011 12:35:36 -0700

Hi Mahesh,

BFD does not only run on UDP, look at the work for BFD for MPLS-TP networks.
One of the advantages of BFD is that protocol packets do not contain any
transport specific information.:)

With that said I agree if there was a mechanism to secure messages over UDP,
that would be better then do the same for every protocol over UDP.

Thanks,
Vishwas
On Wed, Jul 27, 2011 at 11:56 AM, Mahesh Jethanandani <

---

From: Thomas Nadeau <[email-masked]>
Date: Wed, 27 Jul 2011 15:46:49 -0400

BFD also runs inside of pseudo wires ala VCCV and natively inside of MPLS, so I think you have your work cutout if you want to go down this path.

Tom

On Jul 27, 2011, at 3:35 PM, Vishwas Manral <[email-masked]> wrote:

> Hi Mahesh,
>  
> BFD does not only run on UDP, look at the work for BFD for MPLS-TP networks. One of the advantages of BFD is that protocol packets do not contain any transport specific information.:)
>  
> With that said I agree if there was a mechanism to secure messages over UDP, that would be better then do the same for every protocol over UDP.
>  
> Thanks,
> Vishwas
> On Wed, Jul 27, 2011 at 11:56 AM, Mahesh Jethanandani <[email-masked]> wrote: