Re: [babel] [Babel-users] HMAC Key rotation key format (was ripemd)

Dave Taht <dave@taht.net> Thu, 29 November 2018 06:14 UTC

Return-Path: <dave@taht.net>
X-Original-To: babel@ietfa.amsl.com
Delivered-To: babel@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A443B130DC1 for <babel@ietfa.amsl.com>; Wed, 28 Nov 2018 22:14:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J0zhhRG4QRmz for <babel@ietfa.amsl.com>; Wed, 28 Nov 2018 22:14:21 -0800 (PST)
Received: from mail.taht.net (mail.taht.net [176.58.107.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7498912F1AC for <babel@ietf.org>; Wed, 28 Nov 2018 22:14:21 -0800 (PST)
Received: from dancer.taht.net (unknown [IPv6:2603:3024:1536:86f0:eea8:6bff:fefe:9a2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.taht.net (Postfix) with ESMTPSA id AB5C221B39; Thu, 29 Nov 2018 06:14:18 +0000 (UTC)
From: Dave Taht <dave@taht.net>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
Cc: Dave Taht <dave.taht@gmail.com>, Babel at IETF <babel@ietf.org>, Keyur Patel <keyur@arrcus.com>, babel-users <babel-users@lists.alioth.debian.org>, Brian Weis <bew@cisco.com>
References: <CAA93jw5fHRm21yEJsabiiOF1ZP7Zh3M_gEgRo0imBOpRGhf0qA@mail.gmail.com> <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <CAA93jw5gaYgyUX-ABX156_TnFX25Sy5SLyuRgd28fMLfRW4UHA@mail.gmail.com> <871s78x7z0.fsf@toke.dk> <CAA93jw6268QC1kmHEasJ-FbyXL_mgfQc_C-6cdksHd02ceb2Kw@mail.gmail.com> <D6974BC8-4314-47C0-B3D4-6ED8B4C8A528@gmail.com>
Date: Wed, 28 Nov 2018 22:14:07 -0800
In-Reply-To: <D6974BC8-4314-47C0-B3D4-6ED8B4C8A528@gmail.com> (Mahesh Jethanandani's message of "Mon, 26 Nov 2018 11:44:23 -0800")
Message-ID: <87tvk0xvf4.fsf@taht.net>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/babel/5zG_-ZueLrlG1XQpn_bpJqtv-kQ>
Subject: Re: [babel] [Babel-users] HMAC Key rotation key format (was ripemd)
X-BeenThere: babel@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "A list for discussion of the Babel Routing Protocol." <babel.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/babel>, <mailto:babel-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/babel/>
List-Post: <mailto:babel@ietf.org>
List-Help: <mailto:babel-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/babel>, <mailto:babel-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Nov 2018 06:14:24 -0000

Mahesh Jethanandani <mjethanandani@gmail.com> writes:

> A draft that proposed pair-wise key management was proposed here. It
> does not address the question of timestamp, but is something that
> could be exchanged as part of key rollover to allow routers to
> calculate the delta. Including the original authors of the draft.

I'm sorry but adding this level of complexity is not in the cards
from my perspective. Layering key exchange over a different out of band
medium, being a slip of paper, a telephone call, ssh or https seems
saner.

>
>     On Nov 26, 2018, at 6:21 AM, Dave Taht <dave.taht@gmail.com>
>     wrote:
>
>     
>     
>     To me this leaves the biggest problem remaining is key rotation.
>     Me
>     being me, and remembering just how hard it was to get dnssec
>     working
>     on systems lacking reliable time,
>     I worry about that part. What we settled on for dnsmasq-dnssec was
>     to
>     write the current time to flash every day (or few hours), boot up
>     without dnssec enabled long enough to
>     get an ntp server... and rely on key rollover taking hours or days
>     to
>     *usually* get a correct result. RTCs with batteries are usually
>     not
>     included.
>     
>     that's still fragile (imagine a power failure lasting days, or a
>     box
>     being down for several days for repair. It happens).
>     
>     In the case of routing... if you don't have the correct time...
>     and
>     you can't get a route so you can get the correct time from ntp...
>     then
>     what? Do we make GPSes MTI also?
>     
>     Setting that aside for the moment, having a standardized file
>     format
>     for babel keys would be a boon and boost interoperability between
>     bird/babel and other possible implementations.
>     You would merely declare a key name in the main conf for bird or
>     babel, and reference it in a separate file with a format like
>     this:
>     
>     KEY START_DATE END_DATE TYPE VALUE
>     name\wrfc3339\wrfc3339\wsha256|blake2s\wvalue
>     
>     https://tools.ietf.org/html/rfc3339
>     
>     administrators would push out this one standard format file to
>     routers, strongly suggesting that UTC times be used universally
>     and
>     that key rollover should be staged over hours or days lest
>     connectivity be lost. Other sanity checks like ensuring there is
>     some
>     form of persistent and correct time on routers using
>     authentication
>     are also needed.
>     
>     alternatives might include certs and other stuff that bears
>     drinking about.
>     
>     
>     
>     
>     -- 
>     
>     Dave Täht
>     CTO, TekLibre, LLC
>     http://www.teklibre.com
>     Tel: 1-831-205-9740
>     
>     _______________________________________________
>     babel mailing list
>     babel@ietf.org
>     https://www.ietf.org/mailman/listinfo/babel
>     
>
> Mahesh Jethanandani
> mjethanandani@gmail.com
>
>
> _______________________________________________
> Babel-users mailing list
> Babel-users@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/babel-users