Re: [OSPF] Security Extension for OSPFv2 when using Manual Key Management - draft-bhatia-karp-ospf-ip-layer-protection-03

[Curtis Villamizar <[e-mail]>]

In message <[e-mail]>
Acee Lindem writes:
>  
> There was general agreement that this should be a WG document at the
> meeting in Prague. Please indicate your position on making this draft
> a WG document with intended status Proposed Standard.
>  
> Thanks,
> Acee


Yes I support making this a WG item.

One improvement and something pointed out in KARP is that
public/private key pairs are often used and have advantages over
shared keys.  One thing that can be done if a public/private key pair
is used is encrypt a session key for use during a session.  Instead of
a sequence number or session ID, the key itself is exchanged.  That is
somewhat similar to the way kerberos makes use of a session key to
encrypt as little information as possible using the shared secret that
is used to get a tgt from the KDC.  This has an advantage that with a
periodic change in the session key a snooper with access to a lot of
computing resource could still have trouble breaking the session key
before it changed.

For most applications of OSPF this won't matter.  For some it might.

Curtis


And always remember - just because you are paranoid doesn't mean they
are not out to get you.  :-)