Re: New Version Notification for draft-ietf-bfd-optimizing-authentication-02.txt

["Reshad Rahman (rrahman)" <[e-mail]>]

Hi Mahesh,

Couple of questions/comments:

1) I thought the secure sequence number was needed for the NULL Auth TLV
in the optimizing-authentication draft (to make NULL Auth TLV more secure
as per comments from security folks). I guess it could be used with full
authentication also. So I don¹t understand how secure sequence number can
be used ³standalone² as seems to be implied by your cost/benefit table
below.
2) Section 2 mentions ³If the two ends have not previously negotiated
which frames they will transmit or receive with authentication enabled,
then the BFD session will fail to come up, because at least one end will
expect every frame to be authenticated.² How is this negotiation done? Or
is this done via configuration aka outside the scope of this document?


Regards,
Reshad.

On 2017-03-22, 9:57 PM, "Rtg-bfd on behalf of Mahesh Jethanandani"
<[e-mail] on behalf of [e-mail]> wrote:

>
>> On Mar 22, 2017, at 12:35 PM, Jeffrey Haas <[e-mail]> wrote:
>> 
>> This update is scheduled to be discussed at the upcoming session at
>>IETF-98
>> in Chicago.  
>> 
>> The likely discussion is whether the new draft from Sonal should be
>> specifically tied to the advancement of the optimization draft.  Our
>>prior
>> discussion with Alan had suggested some concern about the sequence
>>number
>> issues when we're using NULL authentication.
>> 
>> I suspect some good discussion will happen on this topic at the upcoming
>> session and encourage the members of the Working Group to read both
>>drafts
>> in preparation.
>
>Yes, it would be helpful to read both the drafts in preparation for the
>discussion.
>
>Optimized authentication is not a substitute for sequence number
>obfuscation draft, and vice-versa. They offer different levels of
>cost/benefit, where
>
>Draft                                             Cost        Benefit
>====                                            ====       ======
>sequence number obfuscation     Low        Medium (does not authenticate
>the complete packet)
>optimized authentication              Medium  High       (authenticates
>entire ³state change² packets)
>full authentication                         High       High
>(authenticates all packets)
>
>> 
>> -- Jeff
>> 
>>> On Jan 3, 2017, at 4:37 PM, [e-mail] wrote:
>>> 
>>> 
>>> A new version of I-D, draft-ietf-bfd-optimizing-authentication-02.txt
>>> has been successfully submitted by Mahesh Jethanandani and posted to
>>>the
>>> IETF repository.
>>> 
>>> Name:		draft-ietf-bfd-optimizing-authentication
>>> Revision:	02
>>> Title:		Optimizing BFD Authentication
>>> Document date:	2017-01-05
>>> Group:		bfd
>>> Pages:		8
>>> URL:           
>>>https://www.ietf.org/internet-drafts/draft-ietf-bfd-optimizing-authentic
>>>ation-02.txt
>>> Status:        
>>>https://datatracker.ietf.org/doc/draft-ietf-bfd-optimizing-authenticatio
>>>n/
>>> Htmlized:      
>>>https://tools.ietf.org/html/draft-ietf-bfd-optimizing-authentication-02
>>> Diff:          
>>>https://www.ietf.org/rfcdiff?url2=draft-ietf-bfd-optimizing-authenticati
>>>on-02
>>> 
>>> Abstract:
>>>  This document describes an optimization to BFD Authentication as
>>>  described in Section 6.7 of BFD [RFC5880].
>>> 
>>> 
>>> 
>>> 
>>> 
>>> Please note that it may take a couple of minutes from the time of
>>>submission
>>> until the htmlized version and diff are available at tools.ietf.org.
>>> 
>>> The IETF Secretariat
>> 
>