From isis-wg-bounces@ietf.org Mon May 01 20:38:20 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Faitu-00005X-RS; Mon, 01 May 2006 20:38:02 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Faitu-00005S-1J for isis-wg@ietf.org; Mon, 01 May 2006 20:38:02 -0400 Received: from web25411.mail.ukl.yahoo.com ([217.146.176.229]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1Faitt-0005vT-JO for isis-wg@ietf.org; Mon, 01 May 2006 20:38:02 -0400 Received: (qmail 11173 invoked by uid 60001); 2 May 2006 00:38:00 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=kDyKcGqEUT6jOpY5qK+tfev+3gDmSl+VpEf7mvP22garQylg7EtTgXdZMW9lz/P5foxXdcSieG2qADTpfOksWJ4CbEiaXy//mhmF25o5MABrHmsJVZNLLWhVywLttB/nc9SnuGFSMa2lHGmEGAzaL/vkmctIxErm2cgoY+KgnuQ= ; Message-ID: <20060502003800.11171.qmail@web25411.mail.ukl.yahoo.com> Date: Tue, 2 May 2006 00:38:00 +0000 (GMT) From: Manav Bhatia Subject: Re: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication To: isis-wg@ietf.org In-Reply-To: <4449861F.1070608@ipinfusion.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.9 (/) X-Scan-Signature: bdc523f9a54890b8a30dd6fd53d5d024 X-BeenThere: isis-wg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Manav Bhatia List-Id: IETF IS-IS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isis-wg-bounces@ietf.org Hi, We have updated the draft to include HMAC-SHA-384 and HMAC-SHA-512 authentication modes. There were some other minor comments as well that we had received. Those have been addressed in this version. http://www.ietf.org/internet-drafts/draft-bhatia-manral-isis-hmac-sha-01.txt Would appreciate a feedback from the WG. Cheers, Manav ----- Original Message ---- From: Vishwas Manral To: isis-wg@ietf.org Sent: Saturday, 22 April, 2006 6:55:51 AM Subject: RE: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication Hi Hannes, I mostly agree with Tony here, except for a very corner case where we can amplify a DoS because we have multiple keys to choose between at the receiver during Key Rollover. The point that you bring is an intersting point about KeyRollover. A simple way to do it is to also have the Key-Id (opaque value) sent by the sender. The sender when doing a key rollover will use a different Key ID(which is shared with the receiver). As the receiver will have the key with the same Key-ID it can use that key for calculating the Hash. We will not have to compute the hash with multiple keys which are valid in such a case. The Key lifetime by itself is a very implementation thing(with no effect for interoperability). On another note, as we may now have multiple authentication algorithms to support for any protocol, should we also have an RFC like 4305 for IPsec? That way we do not need to change an RFC which tells about how to use an algorithm(HMAC-SHA1) with IS-IS, but still change the status of algorithm support (e.g. MUST to MAY etc). I am currently the author of the bis version for the RFC and the discussion regarding the same can be seen in the archives. http://www1.ietf.org/mail-archive/web/ipsec/current/index.html Thanks, Vishwas =================================================================== Tony Li wrote: Hannes, > There is a time window (until all routers have the new > authentication key) where the routers holding the new key are > using that key and other routers have not yet got the new key > and hence nothing to verify against. > > so what you require is some form of coordination i.e. > to have all nodes hold off using the new transmit key > up until the network is fully transitioned > (i have seen implementations who achieve that with > time/date based transmit key-selection) -> this requires > some form of coordination (timestamp / key lifetime etc.) Nothing more sophisticated than uniform configuration is required. The first configuration pass installs the new key and enables it for reception. The second configuration pass switches to using the new key for transmission. Those who want to be pedantic can include a third pass to remove the old key. Given the widespread deployment of homegrown tools for consistent, distributed router configuration, I don't see this as a significant hurdle. _______________________________________________ Isis-wg mailing list Isis-wg@ietf.org https://www1.ietf.org/mailman/listinfo/isis-wg _______________________________________________ Isis-wg mailing list Isis-wg@ietf.org https://www1.ietf.org/mailman/listinfo/isis-wg From isis-wg-bounces@ietf.org Tue May 02 19:56:35 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fb4j5-0003Vk-6i; Tue, 02 May 2006 19:56:19 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fb4j4-0003Vf-AP for isis-wg@ietf.org; Tue, 02 May 2006 19:56:18 -0400 Received: from nz-out-0102.google.com ([64.233.162.199]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Fb4j3-0006qp-18 for isis-wg@ietf.org; Tue, 02 May 2006 19:56:18 -0400 Received: by nz-out-0102.google.com with SMTP id f1so44640nzc for ; Tue, 02 May 2006 16:56:16 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=SY3mQpOc0ATaFGqypzGT+SgPRBsRP9JINnwZl48LreJIfmxk6szdQijKlbZTMqk4qK4/46Rse5pjSmXW0voWIgpHip0HyG4VUPRUTQMw+wCn0ekXgXuhklGmorqnDqAYG5ZyY1Ox8xVZX5rNIUtwRgN4ZyzCRIhjbaCJQz2cEq8= Received: by 10.36.134.15 with SMTP id h15mr891072nzd; Tue, 02 May 2006 16:56:16 -0700 (PDT) Received: by 10.36.224.9 with HTTP; Tue, 2 May 2006 16:56:16 -0700 (PDT) Message-ID: <6ed23a860605021656j26579528n1c5b54996ec77622@mail.gmail.com> Date: Wed, 3 May 2006 05:26:16 +0530 From: "Tom Sanders" To: isis-wg@ietf.org Subject: Re: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a X-BeenThere: isis-wg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IETF IS-IS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0662572624==" Errors-To: isis-wg-bounces@ietf.org --===============0662572624== Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64 Content-Disposition: inline SGkgTWFuYXYsCgpJIHdhcyB3b25kZXJpbmcgaWYgeW91IGNvdWxkIGV4cGxhaW4gbWUgaG93IHRo ZSBmYWN0IHRoYXQgdGhlIExTUApsaWZldGltZSBpcyBzZXQgdG8gemVybyBjYW4gYmUgZXhwbG9p dGVkIGJ5IHNvbWVvbmUgZXZlbiB3aGVuIHVzaW5nCkhNQUMtU0hBIGF1dGhlbnRpY2F0aW9uIGFs Z29yaXRobXMsIGFzIHByb3Bvc2VkIGluIHlvdXIgZHJhZnQ/CgpZb3UgbWVudGlvbiB0aGF0IHNv bWUgaGFzaCBmdW5jdGlvbnMgcmVxdWlyZSBhbGwgdGhlIGZpZWxkcyBvZiB0aGUKbWVzc2FnZSB0 ZXh0IFQgdG8gYmUgZmlsbGVkIHdpdGggbm9uIHplcm8gdmFsdWVzLiBJZiBzbywgdGhlbiB3aWxs IGl0Cm5vdCByZXN1bHQgaW4gaW50ZXJvcCBpc3N1ZXMsIHdoZXJlIG9uZSB2ZW5kb3IgZGVjaWRl cyB0byB1c2Ugbm9uIHplcm8KdmFsdWVzIGFuZCB0aGUgb3RoZXIgZGVjaWRlcyB0byBmaWxsIHNv bWUgZmllbGRzIHdpdGggemVyb3M/CgpUb21zLgoKUC5TLgpPdmVyYWxsIHRoZSBkcmFmdCBsb29r cyBjb21wbGV0ZSBhbmQgaW4gZ29vZCBzaGFwZSEKCi0tLS0tIE9yaWdpbmFsIE1lc3NhZ2UgLS0t LQpGcm9tOiBNYW5hdiBCaGF0aWEgPG1hbmF2X2JoYXRpYTA2QHlhaG9vLmNvLnVrPgpUbzogaXNp cy13Z0BpZXRmLm9yZwpTZW50OiBUdWVzZGF5LCAyIE1heSwgMjAwNiA2OjA4OjAwIEFNClN1Ympl Y3Q6IFJlOiBbSXNpcy13Z10gSVMtSVMgSE1BQyBTSEEgQ3J5cHRvZ3JhcGhpYyBBdXRoZW50aWNh dGlvbgoKCkhpLAoKV2UgaGF2ZSB1cGRhdGVkIHRoZSBkcmFmdCB0byBpbmNsdWRlIEhNQUMtU0hB LTM4NCBhbmQgSE1BQy1TSEEtNTEyCmF1dGhlbnRpY2F0aW9uIG1vZGVzLiBUaGVyZSB3ZXJlIHNv bWUgb3RoZXIgbWlub3IgY29tbWVudHMgYXMgd2VsbAp0aGF0IHdlIGhhZCByZWNlaXZlZC4gVGhv c2UgaGF2ZSBiZWVuIGFkZHJlc3NlZCBpbiB0aGlzIHZlcnNpb24uCgpodHRwOi8vd3d3LmlldGYu b3JnL2ludGVybmV0LWRyYWZ0cy9kcmFmdC1iaGF0aWEtbWFucmFsLWlzaXMtaG1hYy1zaGEtMDEu dHh0CgpXb3VsZCBhcHByZWNpYXRlIGEgZmVlZGJhY2sgZnJvbSB0aGUgV0cuCgpDaGVlcnMsCk1h bmF2CgotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0KRnJvbTogVmlzaHdhcyBNYW5yYWwgPHZp c2h3YXNAaXBpbmZ1c2lvbi5jb20+ClRvOiBpc2lzLXdnQGlldGYub3JnClNlbnQ6IFNhdHVyZGF5 LCAyMiBBcHJpbCwgMjAwNiA2OjU1OjUxIEFNClN1YmplY3Q6IFJFOiBbSXNpcy13Z10gSVMtSVMg SE1BQyBTSEEgQ3J5cHRvZ3JhcGhpYyBBdXRoZW50aWNhdGlvbgoKCkhpIEhhbm5lcywKCkkgbW9z dGx5IGFncmVlIHdpdGggVG9ueSBoZXJlLCBleGNlcHQgZm9yIGEgdmVyeSBjb3JuZXIgY2FzZSB3 aGVyZSB3ZQpjYW4gYW1wbGlmeQphIERvUyBiZWNhdXNlIHdlIGhhdmUgbXVsdGlwbGUga2V5cyB0 byBjaG9vc2UgYmV0d2VlbiBhdCB0aGUgcmVjZWl2ZXIgZHVyaW5nIEtleQpSb2xsb3Zlci4KCgoK LS0KVG9tcy4K --===============0662572624== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isis-wg mailing list Isis-wg@ietf.org https://www1.ietf.org/mailman/listinfo/isis-wg --===============0662572624==-- From isis-wg-bounces@ietf.org Wed May 03 01:17:49 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fb9k4-0003t6-0f; Wed, 03 May 2006 01:17:40 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fb9k2-0003t0-Og for isis-wg@ietf.org; Wed, 03 May 2006 01:17:38 -0400 Received: from smtp007.mail.ukl.yahoo.com ([217.12.11.96]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1Fb9k2-0003NJ-2Y for isis-wg@ietf.org; Wed, 03 May 2006 01:17:38 -0400 Received: (qmail 66863 invoked from network); 3 May 2006 05:17:27 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=Received:Reply-To:From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-MimeOLE:Thread-Index:In-Reply-To; b=rPFAULm8OgpsyHlBR8RLNRWxibJUiw6EuCvKbnwcqME6k0mHns6z2FRC6pm20EicbQJOQ6CwIl4VpFKlNZqNiQJG/LooZCI0VNBaCWCg7y0Q1ULl6Pp+nVPJsHjP79AWuhrNbWy8nwz8LmDvt0Kgevt+aZhHSecbfI/it1xBmTs= ; Received: from unknown (HELO pfloyd) (manav?bhatia06@202.144.106.189 with login) by smtp007.mail.ukl.yahoo.com with SMTP; 3 May 2006 05:17:26 -0000 From: "Manav Bhatia" To: "'Tom Sanders'" Subject: RE: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication Date: Wed, 3 May 2006 10:47:20 +0530 Message-ID: <013901c66e70$dbf3ac50$2603a8c0@rs.riverstonenet.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869 Thread-Index: AcZuRA6xaMUX3gaoR5+QsWnek3NCWwAKjJ8g In-Reply-To: <6ed23a860605021656j26579528n1c5b54996ec77622@mail.gmail.com> X-Spam-Score: 0.9 (/) X-Scan-Signature: 32b73d73e8047ed17386f9799119ce43 Cc: isis-wg@ietf.org X-BeenThere: isis-wg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: manav_bhatia06@yahoo.co.uk List-Id: IETF IS-IS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isis-wg-bounces@ietf.org Toms, ] -----Original Message----- ] From: Tom Sanders [mailto:toms.sanders@gmail.com] ] Sent: Wednesday, May 03, 2006 5:26 AM ] To: isis-wg@ietf.org ] Subject: Re: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication ] ] Hi Manav, ] ] I was wondering if you could explain me how the fact that the ] LSP lifetime is set to zero can be exploited by someone even ] when using HMAC-SHA authentication algorithms, as proposed in ] your draft? Since the Remaining Lifetime is set to zero before computing the authentication, it means that we don't authenticate this particular field. And this is done so that the LSPs may be aged by routers in between without requiring them to recompute the authentication data. An attacker can set the lifetime to 0 and flood the LSP. The reciever will not know that this LSP has been tampered with, as the authentication data is left intact. This LSP will thus be installed by the this router and would prematurely expire causing all sorts of problem (denial of service). ] ] You mention that some hash functions require all the fields ] of the message text T to be filled with non zero values. If ] so, then will it not result in interop issues, where one ] vendor decides to use non zero values and the other decides ] to fill some fields with zeros? No, this will not cause any interop issues. Any implementation supporting the MD4 family of hash functions (described in this draft) MUST set all the fields to zero, as described in this draft. This is an advisory note inserted for other hash functions (eg. CRC based polynomials) not covered in this document. Cheers, Manav ] ] Toms. ] ] P.S. ] Overall the draft looks complete and in good shape! ] ] ----- Original Message ---- ] From: Manav Bhatia ] To: isis-wg@ietf.org ] Sent: Tuesday, 2 May, 2006 6:08:00 AM ] Subject: Re: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication ] ] ] Hi, ] ] We have updated the draft to include HMAC-SHA-384 and ] HMAC-SHA-512 authentication modes. There were some other ] minor comments as well that we had received. Those have been ] addressed in this version. ] ] http://www.ietf.org/internet-drafts/draft-bhatia-manral-isis-h ] mac-sha-01.txt ] ] Would appreciate a feedback from the WG. ] ] Cheers, ] Manav ] ] ----- Original Message ---- ] From: Vishwas Manral ] To: isis-wg@ietf.org ] Sent: Saturday, 22 April, 2006 6:55:51 AM ] Subject: RE: [Isis-wg] IS-IS HMAC SHA Cryptographic Authentication ] ] ] Hi Hannes, ] ] I mostly agree with Tony here, except for a very corner case ] where we can amplify a DoS because we have multiple keys to ] choose between at the receiver during Key Rollover. ] ] ] ] -- ] Toms. ] Send instant messages to your online friends http://uk.messenger.yahoo.com _______________________________________________ Isis-wg mailing list Isis-wg@ietf.org https://www1.ietf.org/mailman/listinfo/isis-wg From isis-wg-bounces@ietf.org Tue May 16 16:34:41 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fg6F0-00065b-JW; Tue, 16 May 2006 16:34:02 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fg6Ez-00065O-AC; Tue, 16 May 2006 16:34:01 -0400 Received: from stsc1260-eth-s1-s1p1-vip.va.neustar.com ([156.154.16.129] helo=chiedprmail1.ietf.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Fg5im-0003UQ-KF; Tue, 16 May 2006 16:00:44 -0400 Received: from chsc1260-eth-s1-s1p1-vip.va.neustar.com ([156.154.24.129] helo=willow.neustar.com) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1Fg5YQ-0001aR-2n; Tue, 16 May 2006 15:50:03 -0400 Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by willow.neustar.com (8.12.8/8.12.8) with ESMTP id k4GJo11I026554 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 16 May 2006 19:50:01 GMT Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1Fg5YP-0007l4-NM; Tue, 16 May 2006 15:50:01 -0400 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Tue, 16 May 2006 15:50:01 -0400 X-Spam-Score: -5.9 (-----) X-Scan-Signature: c3a18ef96977fc9bcc21a621cbf1174b Cc: isis-wg@ietf.org Subject: [Isis-wg] I-D ACTION:draft-ietf-isis-ipv6-te-03.txt X-BeenThere: isis-wg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IETF IS-IS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isis-wg-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IS-IS for IP Internets Working Group of the IETF. Title : IPv6 Traffic Engineering in IS-IS Author(s) : J. Harrison, et al. Filename : draft-ietf-isis-ipv6-te-03.txt Pages : 10 Date : 2006-5-16 This document specifies a method for exchanging IPv6 Traffic Engineering information using the IS-IS routing protocol. The described method uses three new TLVs, together with two new sub-TLVs of the Extended IS Reachability TLV. The information distributed allows a CSPF algorithm to calculate traffic engineered routes using IPv6 addresses. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isis-ipv6-te-03.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-isis-ipv6-te-03.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-isis-ipv6-te-03.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2006-5-16132548.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-isis-ipv6-te-03.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-isis-ipv6-te-03.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2006-5-16132548.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isis-wg mailing list Isis-wg@ietf.org https://www1.ietf.org/mailman/listinfo/isis-wg --NextPart--