Re: Authentication

[David Ward <[e-mail]>]

We have been told that the document will not proceed w/o SHA-1 being
mandatory. MD5 is also strongly suggested. An implementation can choose to
also offer no authentication. The protocol can easily support all three
options for deployment. 

-DWard

On Thu, Mar 17, 2005 at 12:00:21PM -0700, Dave Katz wrote:
> 
> On Mar 17, 2005, at 11:40 AM, Gray, Eric wrote:
> 
> > Dave,
> >
> > 	Is it actually the case that the IESG will not allow
> > the document to advance without requiring SHA-1, or is it
> > the case that we either mandate it or we define the security
> > and/or trust environment in which it is, or is not, required?
> 
> I'm not sure, Dave2 or Jeff could comment.  My impression was that they 
> would not let the document advance without it being fully mandatory.
> 
> >
> > 	One could make the case that authentication is not
> > required for devices that are not directly exposed to the
> > big I.  In such devices, it could also be the case that
> > realistic authentication is unlikely to be feasible. In
> > that case, and assuming that making an attempt to provide
> > authentication that is even approximately realistic has a
> > non-zero cost - even if it is never turned on - why would
> > we want to mandate authentication for such devices?\
> 
> I fully agree.
> 
> I suspect that the reality is that most vendors who are only interested 
> in single hop BFD will throw a CPU-based authentication implementation 
> in and continue to use the TTL hack and nobody will use it.  Or else 
> they will just leave it out (but then some customer will demand it 
> because the spec says it has to be there, and they'll be forced to do 
> the above.)
> 
> --Dave