Subject: BFD base comments

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 15 Sep 2008 16:04:06 +0530

Hi,

I noted that in the BFD base spec while processing a BFD packet with
authentication, we first check the MD5 digest and then later check the
sequence number. I think the order needs to be reversed.

If we check the sequence number after doing a MD5 digest verification,
even if we get replayed packets, we will be doing the costly hash
operations, thus wasting a lot of CPU and exposing ourselves to simple
CPU exhaustion attacks.

Is there a reason we do the sequence number checks later and not
before like other checks?

Thanks,
Vishwas