Re: [RPSEC] Issues with existing Cryptographic Protection Methods for Routing Protocols

Thanks Ron.

Yes, I think TCP Auth is much better than current MD5 mechanism
defined currently. We certainly could refer it in our draft (as a
method to provide better security). It will be useful for LDP too
besides just BGP.

The OSPF part is good too. However our aim is to point out issues with
the protocol security mechanisms.

Thanks again,
Vishwas

On Feb 13, 2008 8:13 AM, Ron Bonica <rbonica@juniper.net> wrote:
> Guys,
>
> This is a good summary. Thank you for writing it.
>
> Do you think that it would be helpful to mention that some protocols
> (e.g., OSPFv2) have mechanisms for graceful rekeying.
>
> Also, do you think that it might be helpful to consider
> draft-ietf-tcpm-tcp-auth-opt wrt BGP?
>
>                                         Ron
>
>
>
> Bhatia, Manav (Manav) wrote:
> > Folks,
> >
> > We have posted a revised version of the above draft. Would appreciate
> > feedback from the WG.
> >
> > Routing protocols are designed to use cryptographic mechanisms to
> > authenticate data being received from a neighboring router to ensure
> > that it has not been modified in transit, and actually originated from
> > the neighboring router purporting to have originating the data. Most of
> > the cryptographic mechanisms defined to date rely on hash algorithms
> > applied to the data in the routing protocol packet, which means the data
> > is transported, in the clear, along with a signature based on the data
> > itself.  These mechanisms rely on the manual configuration of the keys
> > used to seed, or build, these hash based signatures.  This document
> > outlines some of the problems with manual keying of these cryptographic
> > algorithms.
> >
> > http://www.ietf.org/internet-drafts/draft-manral-rpsec-existing-crypto-0
> > 5.txt
> >
> > Thanks,
> > Vishwas, Russ and Manav
> > _______________________________________________
> > RPSEC mailing list
> > RPSEC@ietf.org
> > http://www.ietf.org/mailman/listinfo/rpsec
> >
> _______________________________________________
> RPSEC mailing list
> RPSEC@ietf.org
> http://www.ietf.org/mailman/listinfo/rpsec
>
_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
http://www.ietf.org/mailman/listinfo/rpsec