Re: Changing keys in OSPFv3 (draft-ietf-ospf-ospfv3-auth-03.txt)

[[e-mail]]

Sounds reasonable Acee. I will use "One way to control.."
when I add the text to the draft.

> -----Original Message-----
> From: Mailing List [mailto:[e-mail]]On Behalf Of ext
> Acee Lindem
> Sent: Friday, December 05, 2003 3:20 PM
> To: [e-mail]
> Subject: Re: Changing keys in OSPFv3
> (draft-ietf-ospf-ospfv3-auth-03.txt)
> 
> 
> Hi Mukesh,
> 
> I like it except it almost implies that KeyRollloverInterval is a
> protocol constant. Maybe
> it just because I implement the concept of key lifetime (similar to
> another vendor). Perhaps
> you could replace the statement "To control the progression from one
> step to the next" with
> "One way to control the progression  from on step to the next is for
> each router on the link
> to have...".
> 
> All,
> 
> We are ready to last call this document. Please take a look at it. We
> recently changed
> the source address selection algorithm for virtual links.
> 
> 
> Thanks,
> Acee
> 
> [e-mail] wrote:
> 
> >Group,
> >
> >As we had decided to add a section on changing OSPFv3 keys without
> >breaking adjacencies, here is the text Me, Paul and Suresh came up
> >with.
> >
> >Comments are welcome. I will wait for the comments till Monday and
> >then I will add this in the draft.
> >
> >Regards
> >Mukesh
> >
> >===================================================================
> >X. Changing Keys
> >
> >To maintain the security of a link, it may be desirable to change the
> >key values from time to time.  The following three step procedure MAY
> >be provided to rekey the routers on a link without dropping OSPFv3
> >protocol packets or disrupting the adjacency.
> >
> >1. For every router on the link, create an additional input SA for
> >the interface being rekeyed using a new SPI and the new key.
> >
> >2. For every router on the link, replace the original output 
> SA with one
> >using the the new SPI and key values.  The SA replacement operation
> >should be atomic with respect to sending OSPFv3 packets on 
> the link so
> >that no OSPFv3 packets are sent without authentication/encryption.
> >
> >3. For every router on the link, remove the original input SA.
> >
> >Note that all the routers on the link must complete step 1 before any
> >begin step 2.  Likewise, all the routers on the link must 
> complete step
> >2 before any begin step 3.
> >
> >To control the progression from one step to the next, each 
> router has a
> >configurable time constant KeyRolloverInterval.  After the 
> router begins
> >step 1 on a given link, it waits for this interval and then moves to
> >step 2.  Likewise, after moving to step 2, it waits for this interval
> >and then moves to step 3.
> >
> >In order to achieve smooth key transition, all the routers on a link
> >should use the same value for KeyRolloverInterval, and 
> should initiate
> >the key rollover process within this time period.
> >
> >At the end of this procedure, all the routers will have a 
> single input
> >and output SA for OSPFv3 on the link with the new SPI and key values.
> >=====================================================================
> >
> >
> >
>