IETF Logo Mail Archive

Re: [lisp] Deriving Map-Register/Notify authentication key from PSK [Was: Re: Benjamin Kaduk's Discuss on draft-ietf-lisp-rfc6833bis-24: (with DISCUSS and COMMENT)]

Benjamin Kaduk <kaduk@mit.edu> Sat, 23 March 2019 13:08 UTC

Return-Path: <kaduk@mit.edu>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC5141277C9; Sat, 23 Mar 2019 06:08:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9x_L_FvoUHrP; Sat, 23 Mar 2019 06:08:40 -0700 (PDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C4FE12426E; Sat, 23 Mar 2019 06:08:40 -0700 (PDT)
Received: from kduck.mit.edu (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x2ND8ZhA018589 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 23 Mar 2019 09:08:37 -0400
Date: Sat, 23 Mar 2019 08:08:34 -0500
From: Benjamin Kaduk <kaduk@mit.edu>
To: Dino Farinacci <farinacci@gmail.com>
Cc: Fabio Maino <fmaino@cisco.com>, lisp-chairs@ietf.org, The IESG <iesg@ietf.org>, draft-ietf-lisp-rfc6833bis@ietf.org, lisp@ietf.org
Message-ID: <20190323130834.GX88959@kduck.mit.edu>
References: <154954743968.23471.9935733647283605722.idtracker@ietfa.amsl.com> <0d5057bf-46a4-afa2-0794-09c444cfde99@cisco.com> <20190320150544.GE80498@kduck.mit.edu> <BB32AA11-8316-4FB5-900B-234D87E140AF@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <BB32AA11-8316-4FB5-900B-234D87E140AF@gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/lisp/sSL9OQGgCF6mqkWc1hq_Du1M2YI>
Subject: Re: [lisp] Deriving Map-Register/Notify authentication key from PSK [Was: Re: Benjamin Kaduk's Discuss on draft-ietf-lisp-rfc6833bis-24: (with DISCUSS and COMMENT)]
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 23 Mar 2019 13:08:43 -0000

On Wed, Mar 20, 2019 at 03:27:26PM -0700, Dino Farinacci wrote:
> Ben regarding using PSKs for Map-Registers. How about we do this:
> 
> (1) The ETR and map-server can be provisioned with up to 256 keys.
> (2) Each Map-Register uses one of the 256 keys buy doing a random number modulo 256.
> (3) Each consecutive Map-Register will use a different key.
> (4) The Map-Server would do the same for Map-Notify messages.
> 
> A key could only be used once very 4 hours.
> 
> And then a new 256 set of keys can be re-configured via a provisioning system.
> 
> How does that sound?

I'm not sure I understand the need for "use a different key for consecutive
messages", but probably we should just talk about that on Tuesday.

-Benjamin

v2.23.0 | Report a Bug | By Email