Re: [OPSEC] draft-bhatia-manral-igp-crypto-requirements

["Bhatia, Manav (Manav)" <[e-mail]>]

Hi,

The latest version of the above draft can be found here:

http://www.ietf.org/internet-drafts/draft-bhatia-manral-igp-crypto-requirements-03.txt

To cite one example, the draft in section 4.2 recommends the following for OSPFv2:

"This section details the authentication algorithm requirements for standards conformant OSPF implementations. 
    
Keyed MD5 is a MUST as defined in [RFC2328]. It is our understanding that this will get superseded by HMAC-SHA-1 as defined in [OSPF-HMAC]. Keyed MD5 thus MUST be implemented, but its use may get deprecated in future. Implementations should start providing support for HMAC-SHA-1 as this will get promoted to a MUST in the future. 
    
Operators should meanwhile start migrating towards HMAC-SHA-1 if they want to use stronger cryptographic algorithms for authenticating their OSPFv2 packets. 
    
Implementations may start providing support for HMAC-SHA-256/HMAC-SHA-384/HMAC-SHA-512 as these algorithms may get upgraded to a SHOULD in the future."

This way we've retained the IETF terminology while giving an idea of where a particular algorithm is headed in the future.

Cheers, Manav

P.S.

[OSPF-HMAC] Bhatia, M., Manral, V., et al., "OSPF HMAC-SHA Cryptographic Authentication", Work in Progress 

This draft is very mature, and an implementation is already underway. It should be "WG last called" pretty soon in the OSPF WG. [ISIS-HMAC] mentioned in the draft has already been published as RFC 5310 (http://tools.ietf.org/rfc/rfc5310.txt).

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] 
> On Behalf Of Joel Jaeggli
> Sent: Thursday, February 26, 2009 11.26 AM
> To: Vishwas Manral
> Cc: opsec wg mailing list
> Subject: Re: [OPSEC] draft-bhatia-manral-igp-crypto-requirements
> 
> Vishwas Manral wrote:
> > Hi Joel,
> > 
> > Thanks for your comment on the document.
> > 
> >> We have the issue of vulnerable today vs problematic today, or
> >> tomorrow... I feel very comfortable saying there are some 
> places where
> >> md5 is used today that I'd really prefer to not be using 
> it in 5 years.
> > If I understood you right, you are saying stating the fact that its
> > used now though we would prefer it was not used. That was the exact
> > idea of MUST-, SHOULD+ etc we had used in the document earlier.
> 
> I side with Sandra Murphy on the value of that particular language. If
> my concern is that I should not be running something in the future I
> want to simply state that. we take that concern expressed in an
> informational document back to implementation.
> 
> > It gives an idea of direction of where the support of a particular
> > algorithm is heading towards. However based on the comments in the
> > list we modified the document to use standard IETF terminology.
> 
> Which I concur with.
> 
> joel
> 
> > Thanks,
> > Vishwas