Subject: [saag] Keychain implementation issues

From: RJ Atkinson <[email-masked]>
Date: Tue, 3 Nov 2015 20:03:36 -0500

(The note sent to SAAG on October 27th about
 KeyChain YANG vs KeyTable YANG brought the
 topic of this email to the front of my mind.) 

I was at Cisco when the original KeyChain implementation
was undertaken by PST.  I believe that the original Cisco
(Classic) IOS KeyChain implementation for routing protocol 
authentication, IGNORED the KeyID (or equivalent) field 
and simply tried all of the keys present, accepting the 
received packet as valid once any key passed the mathematical 
validation checks.

I understand that implementation strategy also was used by
other KeyChain implementations at a range of different firms.

A result of this implementation choice is to multiply the
adversary’s effectiveness for a “blind" DDOS attack on a 
router’s CPU by the number of keys present for a given 
routing protocol.

(ASIDE: I have reason to believe that such blind DDOS attacks
on routing protocols have been seen on the deployed Internet, 
so posting this note does not increase operational risk.)

A better implementation approach would be to ALWAYS
use the KeyID field (or equivalent, depending upon the
protocol) and other Security Association selection parameters 
to select a SINGLE key to use in attempting the mathematics 
to validate a received routing protocol packet.  That
reduces such attacks to at-most 1 expensive computation 
per received routing protocol packet.

Also, except in the event of a key management fault
[e.g., see discussion in RFC-4822, Section 5.1 (2)],
any expired keys ought not be used to attempt to validate
a received routing protocol packet.

These issues are somewhat orthogonal to the question of
how one ought to structure a YANG module for routing
protocol authentication information, but one certainly
hopes that deployed implementations of the KeyChain
method either have been or soon will be updated to
ONLY check a key if the KeyID value for that key,
and the Routing Protocol value for that key, and any
other Security Association selection criteria 
match the received routing protocol packet.

Yours,

Ran