[OPSEC] draft-bhatia-manral-igp-crypto-requirements-00.txt

Hi,

> > 
> > http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requ
> irements-00
> > 
> > I have concerns about this document making protocol 
> > requirements within the scope of our charter. Making this a 
> > set of protocol best practices I think hews more closely to 
> > our charter (and doesn't belong in routing).
> > 
> > any thoughts on that?
> > 
> I see the benefit in having a document which recommends which routing
> protocol authentication schemes to use.  Having such a document
> available, will automatically put pressure on the routing protocol
> developers to implement what's missing (in case there are still some
> implementations out there which still do not support this).

Agree. 

I think this document too falls in the purview of OPSEC as this would
ensure interop between disparate router implementations where at least
one strong crypto algorithm is available that's implemented by all
vendors.

For example, we need to move folks using OSPF away from keyed MD5 and
there should be some document that suggests that. It should also be
noted that an algorithm that's considered strong today can be broken
tomorrow and may have vulnerabilities that can be exploited. In such
cases, we must have a document that vendors/operators can look up
against, before implementing/using a routing protocol security scheme.

This document does exactly that - it, to cite the same example,
discourages people running OSPF from using keyed MD5 (it's a MUST-) and
encourages the use of HMAC-SHA-1 [x] and other stronger algorithms. 

> 
> So, I suggest this document should be adopted by the WG but 
> with a more
> "recommend/best practice" focus.

It should be a standards track document. Please look at RFC 4307, 4835,
etc. 

> 
> > problems with manual keying seems straight up our alley.
> > 
> > http://tools.ietf.org/html/draft-manral-rpsec-existing-crypto-05
> > 
> > and I have no reservations for taking that one to our ADs.
> > 
> Agree 100%

True.

Cheers,
Manav

[x] http://tools.ietf.org/html/draft-ietf-ospf-hmac-sha-02
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec