Last Call: <draft-ietf-ospf-security-extension-manual-keying-08.txt> (Security Extension for OSPFv2 when using Manual Key Management) to Proposed Standard

The IESG <> Fri, 03 October 2014 20:48 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 1F26C1A6FF8; Fri, 3 Oct 2014 13:48:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id VT0w-yxCeAVx; Fri, 3 Oct 2014 13:48:01 -0700 (PDT)
Received: from (localhost [IPv6:::1]) by (Postfix) with ESMTP id B8FD41A6F9A; Fri, 3 Oct 2014 13:48:01 -0700 (PDT)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: The IESG <>
To: IETF-Announce <>
Subject: Last Call: <draft-ietf-ospf-security-extension-manual-keying-08.txt> (Security Extension for OSPFv2 when using Manual Key Management) to Proposed Standard
X-Test-IDTracker: no
X-IETF-IDTracker: 5.6.3.p3
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <>
Date: Fri, 03 Oct 2014 13:48:01 -0700
X-Mailman-Version: 2.1.15
List-Id: "IETF announcement list. No discussions." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 03 Oct 2014 20:48:03 -0000

The IESG has received a request from the Open Shortest Path First IGP WG
(ospf) to consider the following document:
- 'Security Extension for OSPFv2 when using Manual Key Management'
  <draft-ietf-ospf-security-extension-manual-keying-08.txt> as Proposed

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the mailing lists by 2014-10-17. Exceptionally, comments may be
sent to instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.


   The current OSPFv2 cryptographic authentication mechanism as defined
   in RFC 2328 and RFC 5709 is vulnerable to both inter-session and
   intra-session replay attacks when using manual keying.  Additionally,
   the existing cryptographic authentication mechanism does not cover
   the IP header.  This omission can be exploited to carry out various
   types of attacks.

   This draft proposes changes to the authentication sequence number
   mechanism that will protect OSPFv2 from both inter-session and intra-
   session replay attacks when using manual keys for securing OSPFv2
   protocol packets.  Additionally, we also describe some changes in the
   cryptographic hash computation that will eliminate attacks resulting
   from OSPFv2 not protecting the IP header.

The file can be obtained via

IESG discussion can be tracked via

No IPR declarations have been submitted directly on this I-D.