Re: [OPSEC] minutes part 2

Vishwas,

Can we please get answers to these questions -- which in fact
are entirely on topic for the OPsec WG, since they are all
operational security matters ?

(Single quotes are from me; double-quotes are from Vishwas'
earlier emails.)

1:  OSPF with Digital Signatures
> OSPF with Digital Signatures is an existing mechanism (RFC-2154).
> Is it discussed at the same level of detail as other mechanisms ?

2:  Filtering of IGP packets
>> I have mentioned cases where they may not be able to be filtered.
>
> Which specific cases ? Please provide a URL for your note to the OPsec
> list where you detailed those cases. I have looked, and I can't find
> that note in the OPsec list web archives, terribly sorry.

This is an immediate operational security issue, if true.
I'm sure I'm not the only person who'd like to understand
the claim more precisely.

3: User interest in SHA mechanisms for IGP authentication
> Do you know of anyone other than US DoD that wants this ?
> (US DoD are the only ones that I can identify, and they are
> saying their interest is only for "policy reasons".)
>
> If so, which users ? which RFPs ?

4:  Availability of SHA mechanisms for IGP authentication
> Further, there are no known shipping implementations of
> SHA authentication for any IETF-specified IGP.
> (I don't know of any that are even "in progress".)
>> We know of a few including a big router vendor. :))

Which ?  How many ?  When ?
Are they shipping now or in progress now ?

5:  Claims made by existing IGP authentication documents
>> However if you see most drafts "security considerations" section,
>> they state that using cryptographic authentication is a panicia for  
>> all evils.

I can't find even one RFC or I-D that says anything similar
to "using cryptographic authentication is a panacea for all evils".

I checked a bunch of documents, which I enumerated in an earlier
email; none contained any such language.

Which specific document does this ?  and on which page ?

Thanks,

Ran

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec