Re: [Rift] Security interop testing between RIFT-Juniper and RIFT-Python successfully completed

[Tony Przygienda <[e-mail]>]

Bruno, <thumbs direction="up"/> and as usual thanks for the work. If you
manage some material, great, otherwise I strip 2 viewgraphs when giving
update to the group

with that we have 2 working interop'ed implementation of the spec

BTW, the juniper binary is not on the free download yet (0.10.* is without
sec envelope) but I'll be prep'ing 0.11 download Bruno was using in the
next 2 weeks here (as I mentioned previously, with much more material
around it included than previously given we're pretty much done with the
spec and schemas) ...

thanks, see you all in CA

-- tony

On Fri, Jul 19, 2019 at 6:52 AM Bruno Rijsman <[e-mail]>
wrote:

> I am happy to report that I have successfully completed interop testing of
> RIFT security between RIFT-Juniper and RIFT-Python [1].
>
> In my earlier e-mail I had already reported that interoperability was
> achieved for the outer security envelope.
>
> Now, interoperability for origin security envelope is also working. As
> before, interop testing included both positive and negative test cases.
> This completes the interop testing of RIFT security.
>
> We did not find any issues that require changes in the draft. (There was
> only one very minor implementation issue which was quickly fixed.)
>
> For an updated feature guide of security in RIFT-Python see [2] (many
> enhancements were added during interop testing).
>
> Much has changed since I wrote the "RIFT Security Review" document [3]
> and, as a result, it is now out of date. I will update it to reflect the
> changes in the draft since May and the recent experiences from interop
> testing. I hope to post the updated version before the RIFT meeting at the
> IETF-105 in Montreal.
>
> [1] https://github.com/brunorijsman/rift-python
>
> [2] http://bit.ly/rift-python-security-feature-guide
>
> [3] http://bit.ly/rift-security-review
>
> — Bruno
>
> PS: The interoperability tests are fully automated using the “interop.py”
> script in the RIFT-Python repository. The results can easily be reproduced
> by anyone with access to the RIFT-Python code (which is publicly available
> in GitHub), the RIFT-Juniper executable, and an AWS instance or physical
> Ubuntu server.
>
>
> On Jul 17, 2019, at 2:41 PM, Bruno Rijsman <[e-mail]> wrote:
>
> Status update on security interop testing between RIFT-Juniper and
> RIFT-Python:
>
> The outer keys are now interoperating fine.
>
> (A) As expected, the adjacency between RIFT-Juniper and RIFT-Python comes
> up to state 3way, when
>
>  (A1) authentication is disabled or
>
>  (A2) authentication is enabled with the same active keys or
>
>  (A3) authentication is enabled with different active keys and
> corresponding accept keys.
>
> (B) As expected, the adjacency between RIFT-Juniper and RIFT-Python does
> not come up to state 3way, when
>
>  (B1) Authentication is enabled on one side but not the other side
>
>  (B2) Authentication is enabled with different active keys and without
> corresponding accept keys
>
> Challenges along the way:
>
>  (C1) Juniper uses SHA-256(key + payload) whereas RIFT-Python uses
> HMAC-SHA-256(key, payload).  Solution: add support for SHA-256(key +
> payload) to RIFT-Python (in addition to HMAC-SHA-256).
>
>  (C2) RIFT-Juniper used different YAML configuration keywords than
> RIFT-Python.  Solution: change RIFT-Python to use the same configuration
> keywords.
>
>  (C3) RIFT-Juniper only support configuration of outer keys on a
> per-interface basis, whereas RIFT-Python support configuring the outer keys
> on a per-node and per-interface basis with an inheritance rule.  Solution:
> for interop testing, only use per-interface configuration.
>
>  (C4) RIFT-Juniper only supports SHA-256, whereas RIFT-Python also
> supports other key lengths (e.g. SHA-224, SHA-384, and more).  Solution:
> limit interop testing to SHA-256.
>
> All four of these issues are implementation issues, and none of these
> issues require any changes to the draft.
>
> Next step: finish interop testing for the origin keys. (I plan to do this
> Thursday  morning, Netherlands time)
>
> — Bruno
>
>
>