Re: [secdir] Review of draft-ietf-opsec-routing-protocols-crypto-issues-04

["Bhatia, Manav (Manav)" <[e-mail]>]

Hi Sam,

> 
> This document talks a lot about collision attacks against MD5 and then
> draws the conclusion that MD5 should not be used as part of a MAC.  I
> agree that it is prudent to provide alternatives to MD5.  However, I
> think the current text implies that collision attacks against MD5 are
> applicable to attacks against the use of MD5 in routing protocols.

Not really. We do mention this at the beginning:

"  The ability to produce a collision does not currently introduce any
   obvious or known attacks on routing protocols. Pre-image attacks have
   the potential to cause problems in the future albeit due to the
   message length there are serious limitations to the feasibility of
   mounting such an attack.

   Protocols themselves have some built-in protection against collision
   attacks. This is because a lot of values for fields in a protocol
   packet are invalid or will produce an unusable packet. For example,
   in OSPF the LSA type can be from 1 to 11. Any other value in the
   field will result in the packet being discarded.

   Assume two packets M and M' are generated which have the same hash.
   The above condition will further reduce the ability to produce a
   message which is also a correct message from the protocol
   perspective, as a lot of potential values are themselves not valid."


> 
> There is an introductory section that describes the difference between
> pre image and collision attacks, but the rest of the document seems to
> ignore the advice of that section.

I think what we're trying to say is the following:

Routing Protocols currently use MD5. There are attacks against MD5, but they may not lead to routing vulnerabilities (Sec 1.1). However, we discourage the use of such algorithms. The exact text that we used for OSPF is this - "Attacks on many applications of MD5 are practical on modern computers. For this reason the general use of these algorithms should to be discouraged.[RFC5709] adds support for using HMAC-SHA with OSPF."

We have currently not found direct vulnerabilities when using MD5 with Routing protocols, but going forward one could actually construct a packet that could adversely affect routing protocol functioning.

Manav

>