[Isis-wg] Fingerprint generation issue-//FW: ISIS-autoconf-04 submitted //FW: New Version Notification for draft-liu-isis-auto-conf-04.txt

["Liubing (Leo)" <[e-mail]>]

Hi Dear all,

As discussed with Les as below, let me elaborate a bit more on the Fingerprint generation issue.

In section 3.3.3 in the draft, it lists some resources for generating distinguishers:
o  MAC address(es)
o  Configured IP address(es)
o  Hardware IDs (e.g.  CPU ID)
o  Device serial number(s)
o  System clock at a certain specific time
o  Arbitrary received packet

However, due to the feedback from the implementation team (as CCed), for small CPE boxes, at the initial stage only MAC address is available most of the time. 
So, it's reasonable to use MAC address as the Sys-id. For Fingerprint, it's tricky to generate high quality random numbers due to the lack of entropy.

For this reason, we defined a "Double-Duplication" resolution mechanism in the 04 version draft. At the time Double-Duplication is detected, the devices have been booted for some time, and there should be enough entropy to tiebreak the double-duplication.

Best regards,
Bing

-----Original Message-----
From: Liubing (Leo) 
Sent: Friday, July 17, 2015 2:41 PM
To: 'Les Ginsberg (ginsberg)'; [e-mail] list
Subject: RE: ISIS-autoconf-04 submitted //FW: New Version Notification for draft-liu-isis-auto-conf-04.txt

> > [Bing] The logic is this:
> > 1. At the initial stage, there is not much entropy for generating a 
> > high quality Fingerprint. (This is the feedback from the 
> > implementation team.) 2. Then, very unfortunately, the sys-id and
> Fingerprint both duplicated.
> > 3. At the time the Double-Duplication is detected, there should be 
> > enough entropy (e.g. lots of random packets, LSP num etc.) to make 
> > tiebreaker of the duplication.
> > Does this sound reasonable for you?
> 
> [Les:] I would prefer that we define a robust fingerprint. This is not 
> that difficult.  If there are concerns about the difficulties please 
> make them public.

[Bing] It's not difficult to "define" one, but for small devices, there is some practical difficulties.
I'll initiate another thread to discuss this issue.