Subject: Re: Authentication Key length

From: danny mitzel <[email-masked]>
Date: Mon, 11 Jun 2001 17:13:22 -0700 (PDT)

> According to RFC 2787 which defines the
> vrrpOperAuthKey,  it should be 16 octets. On the
> other hand, according to RFC 2338, section 5.1, it
> should by 8 octets.
>
> Could anyone clarify this mystery?

the 16 bytes in the vrrpOperAuthKey allows
specification of the 128 bit key required for the
HMAC-MD5 utilized when
vrrpOperAuthType==ipAuthenticationHeader(3).

when:
 - vrrpOperAuthType==noAuthentication(1) then
   vrrpOperAuthKey is ignored and VRRP packet
   8 authentication bytes are zero'd and ignored.
 - vrrpOperAuthType==simpleTextPassword(2) then
   vrrpOperAuthKey is the 8 byte password inserted
   into the VRRP packet 8 authentication bytes.
 - vrrpOperAuthType==ipAuthenticationHeader(3) then
   vrrpOperAuthKey is the 16 byte secret key used
   in the IPsec AH HMAC-MD5 authentication and
   VRRP packet 8 authentication bytes are zero'd
   and ignored (because the AH header is at the
   IP layer).

seems sufficiently confusing to me. ;-)

danny

__________________________________________________
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail - only $35 
a year!  http://personal.mail.yahoo.com/