Changing keys in OSPFv3 (draft-ietf-ospf-ospfv3-auth-03.txt)

[[e-mail]]

Group,

As we had decided to add a section on changing OSPFv3 keys without
breaking adjacencies, here is the text Me, Paul and Suresh came up 
with. 

Comments are welcome. I will wait for the comments till Monday and 
then I will add this in the draft.

Regards
Mukesh

===================================================================
X. Changing Keys

To maintain the security of a link, it may be desirable to change the
key values from time to time.  The following three step procedure MAY
be provided to rekey the routers on a link without dropping OSPFv3
protocol packets or disrupting the adjacency.

1. For every router on the link, create an additional input SA for
the interface being rekeyed using a new SPI and the new key.

2. For every router on the link, replace the original output SA with one
using the the new SPI and key values.  The SA replacement operation
should be atomic with respect to sending OSPFv3 packets on the link so
that no OSPFv3 packets are sent without authentication/encryption.

3. For every router on the link, remove the original input SA.

Note that all the routers on the link must complete step 1 before any
begin step 2.  Likewise, all the routers on the link must complete step
2 before any begin step 3.

To control the progression from one step to the next, each router has a
configurable time constant KeyRolloverInterval.  After the router begins
step 1 on a given link, it waits for this interval and then moves to
step 2.  Likewise, after moving to step 2, it waits for this interval
and then moves to step 3.

In order to achieve smooth key transition, all the routers on a link
should use the same value for KeyRolloverInterval, and should initiate
the key rollover process within this time period.

At the end of this procedure, all the routers will have a single input
and output SA for OSPFv3 on the link with the new SPI and key values.
=====================================================================