Subject: [Isis-wg] Authentication

From: Abhishek Verma <[email-masked]>
Date: Mon, 5 Sep 2005 18:53:58 +0530

Hi,
 Please let me know if my understanding of how LSPs are authenticated in 
ISIS is correct.
 The purpose of authentication in ISIS is not confidentiality, but to verify 
the originator. This means that the LSP (or any other ISIS packet) is not 
encrypted, but a TLV is added at the end of the LSP which carries the 
digest. The reciever, computes the digest on its own, compares it with what 
it recieved, and if both match then it accepts the LSP. The idea is that if 
somebody mangled the packet in between, then the digest will not match and 
the reciever will ignore this LSP.
 This way we can be sure that the LSP that we receive was indeed sent by the 
correct router, unless ofcourse, the eavesdropper is aware of the secret key 
being shared between the two routers.
 Is this correct?
 Thanks,
Abhishek
 --
Institute of Technology, BHU
Varanasi - India
_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg

---

From: Saravana Kumar <[email-masked]>
Date: Mon, 05 Sep 2005 19:29:28 +0530

Hi Abhishek,

Yes, your understanding is correct. The purpose of authentication in 
ISIS is to ensure that only the PDUs sent by authorized sources are 
accepted & processed. However this scheme is not fool proof in the sense 
that it doesnt hold up well against replay attacks. Any malicious router 
can store the PDUs that it has received over the network and send them 
at a later point of time to fool the receiving routers to think that the 
PDU was received from a trusted source and cause some disturbance to the 
network. E.g. Re-sending LSP purges or hello PDUs which were capturned 
when the adjacency state was in INIT.

Having said that, i should add that the LSPs in ISIS are by default 
resilient against replay attacks through the use of sequence numbers, 
i.e any replayed LSP is likely to contain a sequence number which is 
less or same as that of the LSP stored in the receivers LSDB and normal 
protocol flow will ensure that the replayed LSPs are not processed. 
However the hello PDUs in ISIS are vulnerable to the replay attacks 
where any third party can capture the hellos sent at the beginning of a 
session establishment and send them later to bring down the adjacency.

You can check out the draft 
http://www.ietf.org/internet-drafts/draft-manral-rp-existingcrypto-00.txt 
for more details.

Regards,
Saravana

Abhishek Verma wrote:

> Hi,
>  
> Please let me know if my understanding of how LSPs are authenticated 
> in ISIS is correct.
>  
> The purpose of authentication in ISIS is not confidentiality, but to 
> verify the originator. This means that the LSP (or any other ISIS 
> packet) is not encrypted, but a TLV is added at the end of the LSP 
> which carries the digest. The reciever, computes the digest on its 
> own, compares it with what it recieved, and if both match then it 
> accepts the LSP. The idea is that if somebody mangled the packet in 
> between, then the digest will not match and the reciever will ignore 
> this LSP.
>  
> This way we can be sure that the LSP that we receive was indeed sent 
> by the correct router, unless ofcourse, the eavesdropper is aware of 
> the secret key being shared between the two routers.
>  
> Is this correct?
>  
> Thanks,
> Abhishek
>  
> --
>------------------------------------------------------------------------
>