Re: OSPF WG Minutes

[Acee Lindem <[e-mail]>]

Vishwas Manral wrote:
Hi Vishwas,

>Hi Acee,
>
>  
>
>>Acee: In practice, for OSPFv2 the sequence numbers are not monotically
>>increasing; Usage of router's clock for cryptographic sequence number 
>>generation reduces the chance for replay attacks across restarts. 
>>?: OSPF spec does not say it ...
>>    
>>
>Acee, what I meant was that although the OSPF spec does not state that
>we need to use clocks. 
>  
>
Ok - got the update.


>I think the vulnerabilities draft is the right place to state the
>problems that can happen if we do not use a clock (or something
>equivalent which increments even when a system goes down).
>  
>
Ok. I was just state that in practice it is not as easy to exploit as it 
appears.

>Another issue is that even if the sender uses clock for the "sequence
>number" and goes down, all the packets of a previous session can still
>be replayed by another router. So the chance of replay attacks is still
>there.
>  
>
You don't mean all the packets do you? You mean all the packets with the 
last sequence number. So,
if the last packet was a hello, the session could be kept up indefinitely.

Thanks,
Acee

>Thanks,
>Vishwas
>-----Original Message-----
>From: Mailing List [mailto:[e-mail]] On Behalf Of Acee
>Lindem
>Sent: Monday, August 15, 2005 7:50 PM
>To: [e-mail]
>Subject: OSPF WG Minutes
>
>Attached are the minutes from the Paris OSPF WG meeting. Thanks to
>Dimitri for taking them.
>
>Acee
>
>  
>