Subject: Re: using the TCP MD5 protection for BGP - Proposed Standard???

From: Tony Li <[email-masked]>
Date: 28 Jul 1998 16:31:02 -0700

[email-masked] (Sandy Murphy) writes:

> I think everyone agrees that the best solution would be to run your TCP
> session over a suitably protected IPSEC link.  The problem is whether
> IPSEC is available soon enough and enough places.

Given that TCP MD5 has been deployed for quite a while, and IPSEC still
isn't, I think that IPSEC wasn't 'soon enough'.  ;-)

Tony

---

From: "Luis A. Sanchez" <[email-masked]>
Date: Tue, 28 Jul 1998 20:13:31 +0000 (GMT)

Sandy,

	I should have read the archive first, my apologies once
again. I'm glad to hear these discussions took place in the list
although I'm surprised to see that the document didn't reflect the
technical outcome of these discussions. I understand implementation
concerns, time to market issues, etc. still, it would seem to me that
while we all await for the deployment of IPSec in our favorite routers
it *might* be prudent to make "minor" modifications to what we have
available. Just a thought...

Luis

> The security weaknesses of the MD5 approach were discussed in the mailing
> list last December and January.  You can see the archive at
>  ftp://ftp.merit.edu/mail.archives/idr.  The replay problem, the preference
> for HMAC rather than plain MD5, the need for rollover of keys, etc were
> mentioned there.  But others argured that this was good to implement until
> a better authentication mechanism was specified and easy to put into
> specification because it was already (widely) implemented.

---

From: Sandy Murphy <[email-masked]>
Date: Tue, 28 Jul 1998 17:55:40 -0400 (EDT)

Luis, I'm sorry I opened my big mouth.           

Procedure-wise,                                         
- the notes of the working group meeting said that it was the consensus
  that the draft be moved forward as PS
- the routing area director questioned that decision
- a discussion took place on the mailing list, with (as stated above) some
  arguing against PS and suggesting BCP because of the vulnerabilities and
  others arguing for PS to motivate vendors to implement 
- the working group chair sent it to the IESG requesting PS
- two rounds of minor changes to the draft occured
- the IESG approved the draft as an RFC at PS 

and then of course, with an incomplete memory of the outcome of the discussion
of Dec/Jan, I brought the whole thing up again.                             

And as a final note, yes, the term "digital signature" is usually reserved
in crypto circles to describe a public key technique that exhibits the
attribute of "non-repudiation".  I have seen the keyed-MD5 technique called
"keyed cryptographic hash" and the term "Message Authentication Code" is
sometimes used for a symmetric integrity+authentication check.  But         
terminology is not the biggest problem here.

--Sandy