Re: OSPF cryptographic authentication keying

[Acee Lindem <[e-mail]>]

Mukesh Gupta wrote:

>>I have a couple of questions about how keying is established for OSPF
>>cryptographic authentication:
>>
>
> I am assuming that you are talking about OSPFv2.
>
>
>>First of all, which may be a stupid questions, I have the impression the
>>keying is essentially on a pairwise basis, rather than a key being shared
>>among all the entities in an area. Is that correct?
>>
>
> To my knowledge, No. It is not correct. The keys are shared between all the
> entities in an area and they are not on a pairwise basis.


Mukesh,

Keys need only be shared on a per-interface basis. The specification of
authentication type per interface (as opposed to per area) was introduced
between RFCs 1583 and 2178.

Thanks,
Acee

> Using pairwise keys
> in the multicast environment will not work.
>
>
>>Second, how are these keys normally established in today's operational
>>world? I realize this is a bit outside of the scope of OSPF, but do people
>>use manual entry, SNMP, some negotiation framework like ISAKMP, or what?
>>
>
> I think, most of the implementations use manual entry. ISAKMP wouldn't be easy
> to use in the multicast environment OSPF uses. Key negotiation mechanisms for
> multicast are still being explored.
>
> regards
> Mukesh
>
> --
> ******************************************************************
> Work fascinates me. I can look at it for  hours !
> ******************************************************************
> Mukesh Gupta
> Phone: [phone]
> Cell : [phone]
> http://www.iprg.nokia.com/~mgupta
> ******************************************************************
>
>


--
Acee