Re: [secdir] Secdir review of draft-ietf-ospf-multi-instance

[Acee Lindem <[e-mail]>]

Hi Magnus, 

Thanks for the review. See inline. 

On Dec 12, 2011, at 3:10 AM, Magnus Nyström wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors. Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> This document describes a method for allowing multiple instances on
> the same domain in OSPFv2.
> 
> Since the Autype field in OSPFv2 will be halved by this document then
> one concern would have been if there were existing implementations
> using Autype values large enough to set bits in the higher octet.
> According to the authors this is not the case and so the risk of
> re-use of existing Autype values does apparently not exist.

Actually, values greater than 256 are reserved. We've only used two authentication types and we have a third in a WG draft. 

http://www.iana.org/assignments/ospf-authentication-codes/ospf-authentication-codes.xml

Since we made the decision a long time ago to make the authentication algorithm a property of the Security Association (SA) and not the authentication type, we do not anticipate many new authentication types in the future. 

> Conversely, when a router which does not understand this new use of
> the Autype field is presented with a packet from a router that is
> instance-aware (and uses a non-zero instance-id value) it will not
> accept it since it would represent an unknown authentication type. I
> would therefore tend to agree with the authors that the introduction
> of an InstanceID as part of the previous Autype field should not be a
> cause of concern.

Yes. 


> 
> Editorial:
> - Section 2: Unclear sentence: "In support of this capability, this
> document introduces a modified packet header format with the
> Authentication Type field is split into an Instance ID and AuType."
> (Probably the "is" should be removed/replaced)

Yes - I will update in the next revision. 

> 
> - Section 5: Refers to Appendix D but there is no Appendix D.
> Presumably the link should be to Appendix D of OSPFv2.

Yes - I will update this as well. 

I anticipate doing this next week as I'm off of work for the holidays. I will send a follow-up E-mail once it is posted. 

Thanks Again,
Acee 



> 
> -- Magnus