Re: [RPSEC] Issues with existing Cryptographic Protection Methods for Routing Protocols

[Ron Bonica <rbonica at juniper.net>]

Guys,

This is a good summary. Thank you for writing it.

Do you think that it would be helpful to mention that some protocols
(e.g., OSPFv2) have mechanisms for graceful rekeying.

Also, do you think that it might be helpful to consider
draft-ietf-tcpm-tcp-auth-opt wrt BGP?

                                        Ron


Bhatia, Manav (Manav) wrote:
> Folks,
> 
> We have posted a revised version of the above draft. Would appreciate
> feedback from the WG.
> 
> Routing protocols are designed to use cryptographic mechanisms to
> authenticate data being received from a neighboring router to ensure
> that it has not been modified in transit, and actually originated from
> the neighboring router purporting to have originating the data. Most of
> the cryptographic mechanisms defined to date rely on hash algorithms
> applied to the data in the routing protocol packet, which means the data
> is transported, in the clear, along with a signature based on the data
> itself.  These mechanisms rely on the manual configuration of the keys
> used to seed, or build, these hash based signatures.  This document
> outlines some of the problems with manual keying of these cryptographic
> algorithms.
> 
> http://www.ietf.org/internet-drafts/draft-manral-rpsec-existing-crypto-0
> 5.txt
> 
> Thanks,
> Vishwas, Russ and Manav
> _______________________________________________
> RPSEC mailing list
> RPSEC at ietf.org
> http://www.ietf.org/mailman/listinfo/rpsec
> 
_______________________________________________
RPSEC mailing list
RPSEC at ietf.org
http://www.ietf.org/mailman/listinfo/rpsec