Re: OSPF cryptographic authentication keying

[Mukesh Gupta <[e-mail]>]

> I have a couple of questions about how keying is established for OSPF
> cryptographic authentication:

I am assuming that you are talking about OSPFv2.

> First of all, which may be a stupid questions, I have the impression the
> keying is essentially on a pairwise basis, rather than a key being shared
> among all the entities in an area. Is that correct?

To my knowledge, No. It is not correct. The keys are shared between all the
entities in an area and they are not on a pairwise basis. Using pairwise keys
in the multicast environment will not work.

> Second, how are these keys normally established in today's operational
> world? I realize this is a bit outside of the scope of OSPF, but do people
> use manual entry, SNMP, some negotiation framework like ISAKMP, or what?

I think, most of the implementations use manual entry. ISAKMP wouldn't be easy
to use in the multicast environment OSPF uses. Key negotiation mechanisms for
multicast are still being explored.

regards
Mukesh

--
******************************************************************
Work fascinates me. I can look at it for  hours !
******************************************************************
Mukesh Gupta
Phone: [phone]
Cell : [phone]
http://www.iprg.nokia.com/~mgupta
******************************************************************