Re: New Version Notification for draft-ietf-bfd-optimizing-authentication-02.txt

[Greg Mirsky <[e-mail]>]

Dear Authors,
thank you for the update but I still cannot find description of how the
proposed authentication mechanism, should we refer to it as "triggered
authentication", as it applies to use of authentication upon state change
as well as timer expiration, affects BFD State Machine. I do believe that,
especially when state is Up and authentication triggered by a timer, BFD
state machine must be updated to clarify when the received authenticated
packet is validated.
I'm looking forward to discussion at the meeting.

Regards,
Greg

On Fri, Mar 24, 2017 at 3:33 PM, Reshad Rahman (rrahman) <[e-mail]>
wrote:

> Hi Mahesh,
>
> Couple of questions/comments:
>
> 1) I thought the secure sequence number was needed for the NULL Auth TLV
> in the optimizing-authentication draft (to make NULL Auth TLV more secure
> as per comments from security folks). I guess it could be used with full
> authentication also. So I don¹t understand how secure sequence number can
> be used ³standalone² as seems to be implied by your cost/benefit table
> below.
> 2) Section 2 mentions ³If the two ends have not previously negotiated
> which frames they will transmit or receive with authentication enabled,
> then the BFD session will fail to come up, because at least one end will
> expect every frame to be authenticated.² How is this negotiation done? Or
> is this done via configuration aka outside the scope of this document?
>
>
> Regards,
> Reshad.
>
> On 2017-03-22, 9:57 PM, "Rtg-bfd on behalf of Mahesh Jethanandani"
> <[e-mail] on behalf of [e-mail]> wrote:
>
> >
> >> On Mar 22, 2017, at 12:35 PM, Jeffrey Haas <[e-mail]> wrote:
> >>
> >> This update is scheduled to be discussed at the upcoming session at
> >>IETF-98
> >> in Chicago.
> >>
> >> The likely discussion is whether the new draft from Sonal should be
> >> specifically tied to the advancement of the optimization draft.  Our
> >>prior
> >> discussion with Alan had suggested some concern about the sequence
> >>number
> >> issues when we're using NULL authentication.
> >>
> >> I suspect some good discussion will happen on this topic at the upcoming
> >> session and encourage the members of the Working Group to read both
> >>drafts
> >> in preparation.
> >
> >Yes, it would be helpful to read both the drafts in preparation for the
> >discussion.
> >
> >Optimized authentication is not a substitute for sequence number
> >obfuscation draft, and vice-versa. They offer different levels of
> >cost/benefit, where
> >
> >Draft                                             Cost        Benefit
> >====                                            ====       ======
> >sequence number obfuscation     Low        Medium (does not authenticate
> >the complete packet)
> >optimized authentication              Medium  High       (authenticates
> >entire ³state change² packets)
> >full authentication                         High       High
> >(authenticates all packets)
> >
> >>
> >> -- Jeff
> >>
> >>> On Jan 3, 2017, at 4:37 PM, [e-mail] wrote:
> >>>
> >>>
> >>> A new version of I-D, draft-ietf-bfd-optimizing-authentication-02.txt
> >>> has been successfully submitted by Mahesh Jethanandani and posted to
> >>>the
> >>> IETF repository.
> >>>
> >>> Name:               draft-ietf-bfd-optimizing-authentication
> >>> Revision:   02
> >>> Title:              Optimizing BFD Authentication
> >>> Document date:      2017-01-05
> >>> Group:              bfd
> >>> Pages:              8
> >>> URL:
> >>>https://www.ietf.org/internet-drafts/draft-ietf-
> bfd-optimizing-authentic
> >>>ation-02.txt
> >>> Status:
> >>>https://datatracker.ietf.org/doc/draft-ietf-bfd-
> optimizing-authenticatio
> >>>n/
> >>> Htmlized:
> >>>https://tools.ietf.org/html/draft-ietf-bfd-optimizing-authentication-02
> >>> Diff:
> >>>https://www.ietf.org/rfcdiff?url2=draft-ietf-bfd-
> optimizing-authenticati
> >>>on-02
> >>>
> >>> Abstract:
> >>>  This document describes an optimization to BFD Authentication as
> >>>  described in Section 6.7 of BFD [RFC5880].
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> Please note that it may take a couple of minutes from the time of
> >>>submission
> >>> until the htmlized version and diff are available at tools.ietf.org.
> >>>
> >>> The IETF Secretariat
> >>
> >
>
>