Re: Authentication

[Dave Katz <[e-mail]>]

On Mar 17, 2005, at 11:40 AM, Gray, Eric wrote:

> Dave,
>
> 	Is it actually the case that the IESG will not allow
> the document to advance without requiring SHA-1, or is it
> the case that we either mandate it or we define the security
> and/or trust environment in which it is, or is not, required?

I'm not sure, Dave2 or Jeff could comment.  My impression was that they 
would not let the document advance without it being fully mandatory.

>
> 	One could make the case that authentication is not
> required for devices that are not directly exposed to the
> big I.  In such devices, it could also be the case that
> realistic authentication is unlikely to be feasible. In
> that case, and assuming that making an attempt to provide
> authentication that is even approximately realistic has a
> non-zero cost - even if it is never turned on - why would
> we want to mandate authentication for such devices?\

I fully agree.

I suspect that the reality is that most vendors who are only interested 
in single hop BFD will throw a CPU-based authentication implementation 
in and continue to use the TTL hack and nobody will use it.  Or else 
they will just leave it out (but then some customer will demand it 
because the spec says it has to be there, and they'll be forced to do 
the above.)

--Dave