Subject: [RPSEC] Issues with existing Cryptographic Protection Methods for Routing Protocols

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Tue, 12 Feb 2008 06:13:04 +0530

Folks,

We have posted a revised version of the above draft. Would appreciate
feedback from the WG.

Routing protocols are designed to use cryptographic mechanisms to
authenticate data being received from a neighboring router to ensure
that it has not been modified in transit, and actually originated from
the neighboring router purporting to have originating the data. Most of
the cryptographic mechanisms defined to date rely on hash algorithms
applied to the data in the routing protocol packet, which means the data
is transported, in the clear, along with a signature based on the data
itself.  These mechanisms rely on the manual configuration of the keys
used to seed, or build, these hash based signatures.  This document
outlines some of the problems with manual keying of these cryptographic
algorithms.

http://www.ietf.org/internet-drafts/draft-manral-rpsec-existing-crypto-0
5.txt

Thanks,
Vishwas, Russ and Manav
_______________________________________________
RPSEC mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rpsec

---

From: Ron Bonica <[email-masked]>
Date: Wed, 13 Feb 2008 11:13:47 -0500

Guys,

This is a good summary. Thank you for writing it.

Do you think that it would be helpful to mention that some protocols
(e.g., OSPFv2) have mechanisms for graceful rekeying.

Also, do you think that it might be helpful to consider
draft-ietf-tcpm-tcp-auth-opt wrt BGP?

                                        Ron

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Thu, 14 Feb 2008 07:38:52 +0530

Yes, I think it would be good to consider draft-ietf-tcpm-tcp-auth-opt
wrt BGP. We'll do this in the next cut.

Manav

> -----Original Message-----
> From: Ron Bonica [mailto:[email-masked]] 
> Sent: Wednesday, February 13, 2008 9.44 PM
> To: Bhatia, Manav (Manav)
> Cc: [email-masked]
> Subject: Re: [RPSEC] Issues with existing Cryptographic 
> Protection Methods for Routing Protocols
> 
> Guys,
>

---

From: "Vishwas Manral" <[email-masked]>
Date: Wed, 13 Feb 2008 19:08:14 -0800

Thanks Ron.

Yes, I think TCP Auth is much better than current MD5 mechanism
defined currently. We certainly could refer it in our draft (as a
method to provide better security). It will be useful for LDP too
besides just BGP.

The OSPF part is good too. However our aim is to point out issues with
the protocol security mechanisms.

Thanks again,
Vishwas