Re: Changing keys in OSPFv3 (draft-ietf-ospf-ospfv3-auth-03.txt)

[Acee Lindem <[e-mail]>]

Hi Mukesh,

I like it except it almost implies that KeyRollloverInterval is a
protocol constant. Maybe
it just because I implement the concept of key lifetime (similar to
another vendor). Perhaps
you could replace the statement "To control the progression from one
step to the next" with
"One way to control the progression  from on step to the next is for
each router on the link
to have...".

All,

We are ready to last call this document. Please take a look at it. We
recently changed
the source address selection algorithm for virtual links.


Thanks,
Acee

[e-mail] wrote:

>Group,
>
>As we had decided to add a section on changing OSPFv3 keys without
>breaking adjacencies, here is the text Me, Paul and Suresh came up
>with.
>
>Comments are welcome. I will wait for the comments till Monday and
>then I will add this in the draft.
>
>Regards
>Mukesh
>
>===================================================================
>X. Changing Keys
>
>To maintain the security of a link, it may be desirable to change the
>key values from time to time.  The following three step procedure MAY
>be provided to rekey the routers on a link without dropping OSPFv3
>protocol packets or disrupting the adjacency.
>
>1. For every router on the link, create an additional input SA for
>the interface being rekeyed using a new SPI and the new key.
>
>2. For every router on the link, replace the original output SA with one
>using the the new SPI and key values.  The SA replacement operation
>should be atomic with respect to sending OSPFv3 packets on the link so
>that no OSPFv3 packets are sent without authentication/encryption.
>
>3. For every router on the link, remove the original input SA.
>
>Note that all the routers on the link must complete step 1 before any
>begin step 2.  Likewise, all the routers on the link must complete step
>2 before any begin step 3.
>
>To control the progression from one step to the next, each router has a
>configurable time constant KeyRolloverInterval.  After the router begins
>step 1 on a given link, it waits for this interval and then moves to
>step 2.  Likewise, after moving to step 2, it waits for this interval
>and then moves to step 3.
>
>In order to achieve smooth key transition, all the routers on a link
>should use the same value for KeyRolloverInterval, and should initiate
>the key rollover process within this time period.
>
>At the end of this procedure, all the routers will have a single input
>and output SA for OSPFv3 on the link with the new SPI and key values.
>=====================================================================
>
>
>