Subject: RE: Authentication in draft-ietf-idr-bgp4-18.txt - resend

From: "Gray, Eric" <[email-masked]>
Date: Wed, 20 Nov 2002 16:57:39 -0500

Alex,

	I think mandating TCP MD5 is a good thing, but 
I am somewhat surprised at the logic of this assertion.  
Given that the BGP specification's previously proposed 
authentication (the one being removed) must not have 
been exactly mandatory (given that nobody seems to have
implemented it), I am not sure that the need to mandate
TCP MD5 follows from the removal of BGP authentication.

	I believe what you are specifically suggesting is
that the specification should explicitly state that TCP
MD5 authentication must be supported by implementations 
(IAW RFC 1264).

	I suggest changing the following (Appendix E, 3rd
paragraph):

   A local system may protect its BGP connections by using the TCP MD5
   Signature Option [RFC2385].

to read:

   A local system may need to protect its BGP connections by using 
   the TCP MD5 Signature Option [RFC2385].  For this reason, a BGP
   implementation MUST support this option.

Eric W. Gray
Systems Architect
Celox Networks, Inc.
[email-masked]
508 305 7214

> -----Original Message-----
> From: Alex Zinin [mailto:[email-masked]]
> Sent: Wednesday, November 20, 2002 3:52 PM
> To: [email-masked]
> Subject: Authentication in draft-ietf-idr-bgp4-18.txt
> 
> Folks,
> 
>  Now that the BGP-internal authentication has been removed
>  from the spec due to lack of implementations, we're left
>  with no mandatory authentication mechanism (required by
>  RFC1264).
> 
>  It's up to the WG to decide what should be done, but seems
>  that saying that implementations MUST implement TCP MD5 would
>  be a good solution.
> 
> --
> Alex

---

From: Alex Zinin <[email-masked]>
Date: Thu, 21 Nov 2002 10:01:21 -0500

Eric,

 What I was trying to say is that 1264 requires an
 authentication scheme (also expected during the IESG
 review, btw) for a routing proto spec to be advanced,
 and the new spec does not have one. TCP MD5 seemed
 like a logical way to fix this, since this is a de
 facto the most widely deployed authentication scheme.

-- 
Alex

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 21 Nov 2002 10:20:07 -0500

>  review, btw) for a routing proto spec to be advanced,

The point I was trying to ask - perhaps too obtusely - is that
TCP MD5 is not a bgp authentication mechanism.  Is it sufficient
to secure the transport stream to satisfy this requirement?

The requirement states:
"The security architecture must include mechanisms for authenticating
 routing messages and may include other forms of protection."

I don't know how this has been traditionally interpreted.

-- 
Jeff Haas 
NextHop Technologies

---

From: "John G. Scudder" <[email-masked]>
Date: Thu, 21 Nov 2002 11:20:30 -0500

>to secure the transport stream to satisfy this requirement?

I certainly see the reason for your concern.  My take on it is that 
not only is there no technical reason to reject TCP MD5 as an 
authentication mechanism, but as Curtis recently pointed out, there 
is a technical _requirement_ that BGP's security mechanism be 
transport-based.  Call me a Pollyanna, but I think that this should 
be sufficient to satisfy the standards process and that it would make 
no sense to reject it because of artificial layering concerns.

So based on common sense, it seems to me that we are borrowing 
trouble if we get preemptively worried about this point.

--John

---

From: Alex Zinin <[email-masked]>
Date: Thu, 21 Nov 2002 14:55:10 -0500

I agree with John here.
I don't think there will be problems in the IESG
with TCP MD5 as the authentication mechanism.

Alex.