Re: [Isis-wg] Fingerprint generation issue-//FW: ISIS-autoconf-04 submitted //FW: New Version Notification for draft-liu-isis-auto-conf-04.txt

Bing -

Understood that a device can only advertise things that it knows. If it does not have access to serial # (for example) then it cannot use that as part of the fingerprint. But this section "should" be meant to define suggested behavior. The suggested behavior SHOULD be to advertise a fingerprint that is unlikely to be duplicated. The suggestion to use some randomly generated number in such cases is good.

It is Section 3.3.4 that concerns me. When a box restarts it is quite likely that it will receive copies of its LSPs from its previous incarnation. This will appear to be "double duplication" when in fact it is not. If it is NOT double duplication then - as you discuss - when the restarting router generates a new version of its LSP with a higher sequence number the false indication of double duplication will be resolved. It is only when double duplication persists that it can be considered as real. In such cases, using LSP sequence # as a fingerprint extension is not the best choice as if the double duplication is real both of the sytems are quite likely to choose the same new sequence #. Generating a different pseudo-random # in such a case is better.

I think the intent of this section is good - but some clarification is still needed.

   Les

> -----Original Message-----
> From: Isis-wg [mailto:isis-wg-bounces@ietf.org] On Behalf Of Liubing (Leo)
> Sent: Friday, July 17, 2015 12:28 AM
> To: isis-wg@ietf.org list
> Cc: Les Ginsberg (ginsberg); Martin Winter; David Lamparter
> Subject: [Isis-wg] Fingerprint generation issue-//FW: ISIS-autoconf-04
> submitted //FW: New Version Notification for draft-liu-isis-auto-conf-04.txt
> 
> Hi Dear all,
> 
> As discussed with Les as below, let me elaborate a bit more on the
> Fingerprint generation issue.
> 
> In section 3.3.3 in the draft, it lists some resources for generating
> distinguishers:
> o  MAC address(es)
> o  Configured IP address(es)
> o  Hardware IDs (e.g.  CPU ID)
> o  Device serial number(s)
> o  System clock at a certain specific time o  Arbitrary received packet
> 
> However, due to the feedback from the implementation team (as CCed), for
> small CPE boxes, at the initial stage only MAC address is available most of the
> time.
> So, it's reasonable to use MAC address as the Sys-id. For Fingerprint, it's
> tricky to generate high quality random numbers due to the lack of entropy.
> 
> For this reason, we defined a "Double-Duplication" resolution mechanism in
> the 04 version draft. At the time Double-Duplication is detected, the devices
> have been booted for some time, and there should be enough entropy to
> tiebreak the double-duplication.
> 
> Best regards,
> Bing
> 
> -----Original Message-----
> From: Liubing (Leo)
> Sent: Friday, July 17, 2015 2:41 PM
> To: 'Les Ginsberg (ginsberg)'; isis-wg@ietf.org list
> Subject: RE: ISIS-autoconf-04 submitted //FW: New Version Notification for
> draft-liu-isis-auto-conf-04.txt
> 
> > > [Bing] The logic is this:
> > > 1. At the initial stage, there is not much entropy for generating a
> > > high quality Fingerprint. (This is the feedback from the
> > > implementation team.) 2. Then, very unfortunately, the sys-id and
> > Fingerprint both duplicated.
> > > 3. At the time the Double-Duplication is detected, there should be
> > > enough entropy (e.g. lots of random packets, LSP num etc.) to make
> > > tiebreaker of the duplication.
> > > Does this sound reasonable for you?
> >
> > [Les:] I would prefer that we define a robust fingerprint. This is not
> > that difficult.  If there are concerns about the difficulties please
> > make them public.
> 
> [Bing] It's not difficult to "define" one, but for small devices, there is some
> practical difficulties.
> I'll initiate another thread to discuss this issue.
> 
> _______________________________________________
> Isis-wg mailing list
> Isis-wg@ietf.org
> https://www.ietf.org/mailman/listinfo/isis-wg