Subject: Re: New Version Notification for draft-ietf-bfd-optimizing-authentication-02.txt

From: Jeffrey Haas <[email-masked]>
Date: Wed, 22 Mar 2017 15:35:08 -0400

This update is scheduled to be discussed at the upcoming session at IETF-98
in Chicago.  

The likely discussion is whether the new draft from Sonal should be
specifically tied to the advancement of the optimization draft.  Our prior
discussion with Alan had suggested some concern about the sequence number
issues when we're using NULL authentication.

I suspect some good discussion will happen on this topic at the upcoming
session and encourage the members of the Working Group to read both drafts
in preparation.

-- Jeff

> On Jan 3, 2017, at 4:37 PM, [email-masked] wrote:
> 
> 
> A new version of I-D, draft-ietf-bfd-optimizing-authentication-02.txt
> has been successfully submitted by Mahesh Jethanandani and posted to the
> IETF repository.
> 
> Name:		draft-ietf-bfd-optimizing-authentication
> Revision:	02
> Title:		Optimizing BFD Authentication
> Document date:	2017-01-05
> Group:		bfd
> Pages:		8
> URL:            https://www.ietf.org/internet-drafts/draft-ietf-bfd-optimizing-authentication-02.txt
> Status:         https://datatracker.ietf.org/doc/draft-ietf-bfd-optimizing-authentication/
> Htmlized:       https://tools.ietf.org/html/draft-ietf-bfd-optimizing-authentication-02
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-bfd-optimizing-authentication-02
> 
> Abstract:
>   This document describes an optimization to BFD Authentication as
>   described in Section 6.7 of BFD [RFC5880].
> 
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 22 Mar 2017 18:57:41 -0700

> On Mar 22, 2017, at 12:35 PM, Jeffrey Haas <[email-masked]> wrote:
> 

Yes, it would be helpful to read both the drafts in preparation for the discussion.

Optimized authentication is not a substitute for sequence number obfuscation draft, and vice-versa. They offer different levels of cost/benefit, where

Draft                                             Cost        Benefit
====                                            ====       ======
sequence number obfuscation     Low        Medium (does not authenticate the complete packet)
optimized authentication              Medium  High       (authenticates entire “state change” packets)
full authentication                         High       High       (authenticates all packets)

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Fri, 24 Mar 2017 20:33:48 +0000

Hi Mahesh,

Couple of questions/comments:

1) I thought the secure sequence number was needed for the NULL Auth TLV
in the optimizing-authentication draft (to make NULL Auth TLV more secure
as per comments from security folks). I guess it could be used with full
authentication also. So I don¹t understand how secure sequence number can
be used ³standalone² as seems to be implied by your cost/benefit table
below.
2) Section 2 mentions ³If the two ends have not previously negotiated
which frames they will transmit or receive with authentication enabled,
then the BFD session will fail to come up, because at least one end will
expect every frame to be authenticated.² How is this negotiation done? Or
is this done via configuration aka outside the scope of this document?

Regards,
Reshad.

On 2017-03-22, 9:57 PM, "Rtg-bfd on behalf of Mahesh Jethanandani"
<[email-masked] on behalf of [email-masked]> wrote:

>Optimized authentication is not a substitute for sequence number
>obfuscation draft, and vice-versa. They offer different levels of
>cost/benefit, where
>
>Draft                                             Cost        Benefit
>====                                            ====       ======
>optimized authentication              Medium  High       (authenticates
>entire ³state change² packets)
>>> URL:           
>>>https://www.ietf.org/internet-drafts/draft-ietf-bfd-optimizing-authentic
>>>ation-02.txt
>>> Status:        
>>>https://datatracker.ietf.org/doc/draft-ietf-bfd-optimizing-authenticatio
>>>n/
>>> Htmlized:      
>>>https://tools.ietf.org/html/draft-ietf-bfd-optimizing-authentication-02
>>> Diff:          
>>>https://www.ietf.org/rfcdiff?url2=draft-ietf-bfd-optimizing-authenticati
>>>on-02
>>> 
>>> Abstract:

---

From: Greg Mirsky <[email-masked]>
Date: Sat, 25 Mar 2017 17:21:44 -0500

Dear Authors,
thank you for the update but I still cannot find description of how the
proposed authentication mechanism, should we refer to it as "triggered
authentication", as it applies to use of authentication upon state change
as well as timer expiration, affects BFD State Machine. I do believe that,
especially when state is Up and authentication triggered by a timer, BFD
state machine must be updated to clarify when the received authenticated
packet is validated.
I'm looking forward to discussion at the meeting.

Regards,
Greg

---

From: Mahesh Jethanandani <[email-masked]>
Date: Sat, 25 Mar 2017 09:10:35 -0700

> On Mar 24, 2017, at 1:33 PM, Reshad Rahman (rrahman) <[email-masked]> wrote:
> 
> Hi Mahesh,
> 

Sequence number obfuscation is not a replacement for optimized or full authentication. On a spectrum from no authentication to full authentication, I view obfuscation of sequence numbers, deployed by itself, somewhere in the middle to prevent a MITM attack. It does not prevent the packet from being modified, but the session cannot be taken over by MITM, therefore the medium benefit.

It's true benefit, however, comes from it being used in optimized authentication. I do not see a particular advantage when full authentication is done.

> is this done via configuration aka outside the scope of this document?

That is correct.

Mahesh Jethanandani
[email-masked]

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Sun, 26 Mar 2017 15:51:36 +0000

Thanks Mahesh. Then should the sequence number obfuscation be part of the
optimizing-authentication draft? If we keep them as 2 separate documents,
then the optimizing-authentication draft should refer to the sequence
number draft and basically the 2 docs would be tied together?

Regards,
Reshad.

On 2017-03-25, 12:10 PM, "Rtg-bfd on behalf of Mahesh Jethanandani"
<[email-masked] on behalf of [email-masked]> wrote:

>Sequence number obfuscation is not a replacement for optimized or full
>authentication. On a spectrum from no authentication to full
>authentication, I view obfuscation of sequence numbers, deployed by
>itself, somewhere in the middle to prevent a MITM attack. It does not
>prevent the packet from being modified, but the session cannot be taken
>over by MITM, therefore the medium benefit.
>
>It's true benefit, however, comes from it being used in optimized
>authentication. I do not see a particular advantage when full
>authentication is done.
>
>>> sequence number obfuscation     Low        Medium (does not
>>>authenticate
>>> the complete packet)