Subject: Authentication in draft-ietf-idr-bgp4-18.txt

From: Alex Zinin <[email-masked]>
Date: Wed, 20 Nov 2002 15:52:26 -0500

Folks,

 Now that the BGP-internal authentication has been removed
 from the spec due to lack of implementations, we're left
 with no mandatory authentication mechanism (required by
 RFC1264).

 It's up to the WG to decide what should be done, but seems
 that saying that implementations MUST implement TCP MD5 would
 be a good solution.

-- 
Alex

---

From: Jeffrey Haas <[email-masked]>
Date: Wed, 20 Nov 2002 16:04:35 -0500

>  that saying that implementations MUST implement TCP MD5 would

This is problematic since we're relying on a transport mechanism
and not something within the protocol.

-- 
Jeff Haas 
NextHop Technologies

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 20 Nov 2002 16:02:53 -0500

>  that saying that implementations MUST implement TCP MD5 would

If the IETF doesn't say so enough customers certainly do that all
implementations seem to have it.  At least I don't know of any
exceptions.

IMHO It makes perfect sense to mandate TCP MD5.

Curtis

---

From: Russ White <[email-masked]>
Date: Wed, 20 Nov 2002 16:12:48 -0500 (EST)

> IMHO It makes perfect sense to mandate TCP MD5.

Agreed.

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

---

From: Justin Fletcher <[email-masked]>
Date: Wed, 20 Nov 2002 16:20:02 -0800 (PST)

>  that saying that implementations MUST implement TCP MD5 would

I strongly disagree.

This would indicate a change in the base specification; any vendor
implementation which had been previously compliant would suddenly be
non-compliant if TCP MD5 authentication is not supported.

In addition, RFC1264 is an informational; I don't believe conformance
should be considered as a requirement for a standards-track document.

We could recommend implementation of TCP MD5 for authentication,
but it certainly shouldn't be mandatory.
-- 
Justin Fletcher
Proficient Networks, Inc.

---

From: Yakov Rekhter <[email-masked]>
Date: Wed, 20 Nov 2002 16:35:11 -0800

Justin,

> but it certainly shouldn't be mandatory.

As Alex mentioned in his e-mail RFC1264 *requires* a mandatory
authentication mechanism. That is, to have a Draft Standard spec
that doesn't have a mandatory authentication mechanism is *not* an
option.

The BGP-internal authentication has been removed because it wasn't
implemented. So, the only possible mechanism known to me that could
be used to satisfy the rfc1264 requirement is TCP MD5 (as it provides
authentication, and has deployed multi-vendor interoperable
implementations).

If you are aware of any other possible mechanism that satisfies
the rfc1264 requirement *and* has deployed multi-vendor interoperable
implementatations, please mention it, so that we could consider
it as an alternative to TCP MD5. In the absence of such an
alternative we have no choice, but to make TCP MD5 mandatory.

Yakov.

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 20 Nov 2002 20:32:10 -0500

> and not something within the protocol.

You can't protect against a TCP RST error (denial of service attack)
with something within the protocol (solely within the TCP data
stream).  So if you want it to work (assumed requirement) it has to be
in the transport mechanism.

We already clearly indicate that TCP is required.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 20 Nov 2002 21:06:19 -0500

In message <Pine.LNX.4.44.0211201604570.5337-100000@riga>, Justin Fletcher writ
> non-compliant if TCP MD5 authentication is not supported.

Advancing a spec to Draft Standard does not require a unanimous
decision nor does it require that the spec be limited to features that
*every* known implementation conforms to.

> should be considered as a requirement for a standards-track document.

Informational doesn't mean "ignore this document".  The IESG is
"informing" us of the rules by which we have to play to have any
chance of advancing a document.

> but it certainly shouldn't be mandatory.

We have to make it manditory or the IESG will toss the document back
at the WG.  The vast majority of router implementations of BGP have
TCP MD5.  I'm not sure if there is a BSD implementation of TCP MD5
floating around.

Curtis

---

From: Alex Zinin <[email-masked]>
Date: Thu, 21 Nov 2002 10:01:28 -0500

Justin,

 Curtis answered your questions quite well.
 One thing that I wanted to add regarding being compliant:
 since people didn't implement the authentication mechanism
 described in 1771, and TCP MD5 is widely used today, making
 this change in the document will actually increase the level
 of compliancy for the current implementations.

-- 
Alex