Re: OSPF WG Minutes

[ashok <[e-mail]>]

Hi Vishwas,

-----Original Message-----
From: Mailing List [mailto:[e-mail]] On Behalf Of Vishwas
Manral
Sent: Tuesday, August 16, 2005 5:22 PM
To: [e-mail]
Subject: Re: OSPF WG Minutes

Hi Acee,

> You don't mean all the packets do you? You mean all the packets with
> the last sequence number. So, if the last packet was a hello, the 
> session could be kept up indefinitely.
I think there are two parts to it. The first as you are stating it.
Another is when a router has gone down, all the packets from the
beginning could be replayed and the adjacency could be brought up (the
receiver cannot anyway does not check for sequence number before and
after an adjacency has broken).



For this to happen, ALL ospf packets sent by the router which is now down,
has to be stored by the malicious router and it has to be replayed in the
same sequence. However, the LSAs will eventually maxage as the malicious
router cannot possibly refresh the lsas. So the condition is bounded by OSPF
max-age. But, this still does pose a seemingly improbable problem.

Thanks,
Ashok



Thanks,
Vishwas
-----Original Message-----
From: Mailing List [mailto:[e-mail]] On Behalf Of Acee
Lindem
Sent: Tuesday, August 16, 2005 5:16 PM
To: [e-mail]
Subject: Re: OSPF WG Minutes

Vishwas Manral wrote:
Hi Vishwas,

>Hi Acee,
>
>  
>
>>Acee: In practice, for OSPFv2 the sequence numbers are not monotically
>>increasing; Usage of router's clock for cryptographic sequence number 
>>generation reduces the chance for replay attacks across restarts. 
>>?: OSPF spec does not say it ...
>>    
>>
>Acee, what I meant was that although the OSPF spec does not state that
>we need to use clocks. 
>  
>
Ok - got the update.


>I think the vulnerabilities draft is the right place to state the
>problems that can happen if we do not use a clock (or something
>equivalent which increments even when a system goes down).
>  
>
Ok. I was just state that in practice it is not as easy to exploit as it

appears.

>Another issue is that even if the sender uses clock for the "sequence
>number" and goes down, all the packets of a previous session can still
>be replayed by another router. So the chance of replay attacks is still
>there.
>  
>
You don't mean all the packets do you? You mean all the packets with the

last sequence number. So,
if the last packet was a hello, the session could be kept up
indefinitely.

Thanks,
Acee

>Thanks,
>Vishwas
>-----Original Message-----
>From: Mailing List [mailto:[e-mail]] On Behalf Of Acee
>Lindem
>Sent: Monday, August 15, 2005 7:50 PM
>To: [e-mail]
>Subject: OSPF WG Minutes
>
>Attached are the minutes from the Paris OSPF WG meeting. Thanks to
>Dimitri for taking them.
>
>Acee
>
>  
>