Re: Questions about OSPF v3 security draft

[Vishwas Manral <[e-mail]>]

Hi Mike,

 

I think both the authors are on leave, so they will probably reply
later.

 

However regarding the first point, I agree the wording should be
clearer. However what it means is we will use the same crypto-algorithm
and keys for all traffic to a neighbor over an interface.

 

Regarding the second point, I think I too have brought the issue on this
list and the reply I think was that the draft does not prohibit the use
of IKE for unicast flows.

 


Thanks,

Vishwas

________________________________

From: Mailing List [mailto:[e-mail]] On Behalf Of Mike
Fox
Sent: Friday, February 11, 2005 8:04 PM
To: [e-mail]
Subject: Questions about OSPF v3 security draft

 


Regarding
http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-07.txt,
and the previous drafts, a couple of questions have come up in our shop.


1) Section 7, 2nd paragraph says "the implementations MUST use manually
configured keys with same SA for inbound and outbound traffic (as shown
in figure 3).  I assume the "same SA" MUST rule applies to multicast
traffic only and not unicast traffic. This is because an SA is defined
as an SPI, security protocol (AH or ESP), and destination IP address.
For unicast addresses, by definition there will be as many SAs as there
are unicast destination addresses. Therefore, I don't think it is
possible to apply this MUST rule given the current IPSec definition (RFC
2401 section 4.1) of an SA for unicast. Assuming the intention of the
draft was to apply only to multicast and given the number of potential
SAs carrying unicast traffic, it would seem that using IKE to setup the
SAs dynamically would be a reasonable alternative to manual keying.     
  
2)Section 9, 2nd paragraph discusses setting up a "secure IPSec channel
dynamically once it acquires the required information".  Since this
traffic is unicast only, IKE could easily set up the required SAs
without knowing the specific IP addresses in advance. Creating SAs
dynamically do not fit easily within scope of manual SA functional
capabilities. Why not use IKE for this traffic? Is this an acceptable
option?   

Mike 

-----------------------------------------------------------------------
Enterprise Network Solutions
-----------------------------------------------------------------------
Research Triangle Park, NC  USA