Subject: [Isis-wg] comment on hmac-03

From: Nick Amato <[email-masked]>
Date: Tue, 31 Jul 2001 15:11:16 -0400

It is my opinion that section 2.1 of draft-ietf-isis-hmac-03.txt
needs clarification.

If a router restarts when it's time to use a new key, let's first assume
it rolls over its link, area and domain keys.  In this case the rolling-over
router will not become adjacent with neighbors using the old link key and
thus will not receive its old LSP.

Section 2.1 seems to refer to the case where a router changes only,
for example, its area key and not its link key.  In this case the
rolling-over router may become adjacent with neighbor(s) that are
still using the old area key.

This case seems more like a misconfiguration to me as an IS is allowed
to accept more than a single key at once.

Nick Amato
NextHop Technologies
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Naiming Shen <[email-masked]>
Date: Tue, 31 Jul 2001 17:23:37 -0700

]
 ]It is my opinion that section 2.1 of draft-ietf-isis-hmac-03.txt
 ]needs clarification.
 ]
 ]If a router restarts when it's time to use a new key, let's first assume
 ]it rolls over its link, area and domain keys.  In this case the rolling-over
 ]router will not become adjacent with neighbors using the old link key and
 ]thus will not receive its old LSP.
 ]
 ]Section 2.1 seems to refer to the case where a router changes only,
 ]for example, its area key and not its link key.  In this case the
 ]rolling-over router may become adjacent with neighbor(s) that are
 ]still using the old area key.
 ]
 ]This case seems more like a misconfiguration to me as an IS is allowed
 ]to accept more than a single key at once.
 ]

An implementation of ISIS authentication does not have to use a single
key for the whole box. Actually each link can have it's own keys, and
even on each routing level of the link. Users may want to do authentication
only on the LSP packets but not other ISIS packets. Or a user may want to
do simple authentication on one link and hmac on the others. But you are
right, if the whole box uses a single key to rollover for all ISIS packets,
the case in 2.1 should not occur.

thanks.

 ]Nick Amato
 ]NextHop Technologies
 ]_______________________________________________
 ]Isis-wg mailing list  -  [email-masked]
 ]http://external.juniper.net/mailman/listinfo/isis-wg

- Naiming

---

From: Naiming Shen <[email-masked]>
Date: Tue, 31 Jul 2001 17:36:09 -0700

Actually, even if the whole box uses a single key, this problem can
still occur.

The section 2.1 is talking about a case where a key(assume for all
the isis packets) is rolled over at time X, and ISIS process of router A
restarted at that time. All the adjacencies should still come up fine
to use the new key. But the router can not send out it's LSP out since
it's neighbors still have A's old LSP(which has higher seq #), but
router A can't advance it's seq# because it can not authenticate the
old LSP it's neighbors send it back.

 ] ]
 ] ]It is my opinion that section 2.1 of draft-ietf-isis-hmac-03.txt
 ] ]needs clarification.
 ] ]
 ] ]If a router restarts when it's time to use a new key, let's first assume
 ] ]it rolls over its link, area and domain keys.  In this case the rolling-ove
r
 ] ]router will not become adjacent with neighbors using the old link key and
 ] ]thus will not receive its old LSP.
 ] ]
 ] ]Section 2.1 seems to refer to the case where a router changes only,
 ] ]for example, its area key and not its link key.  In this case the
 ] ]rolling-over router may become adjacent with neighbor(s) that are
 ] ]still using the old area key.
 ] ]
 ] ]This case seems more like a misconfiguration to me as an IS is allowed
 ] ]to accept more than a single key at once.
 ] ]
 ]
 ]An implementation of ISIS authentication does not have to use a single
 ]key for the whole box. Actually each link can have it's own keys, and
 ]even on each routing level of the link. Users may want to do authentication
 ]only on the LSP packets but not other ISIS packets. Or a user may want to
 ]do simple authentication on one link and hmac on the others. But you are
 ]right, if the whole box uses a single key to rollover for all ISIS packets,
 ]the case in 2.1 should not occur.
 ]
 ]thanks.
 ]
 ] ]Nick Amato
 ] ]NextHop Technologies
 ] ]_______________________________________________
 ] ]Isis-wg mailing list  -  [email-masked]
 ] ]http://external.juniper.net/mailman/listinfo/isis-wg
 ]
 ]- Naiming

- Naiming

---

From: Tony Przygienda <[email-masked]>
Date: Tue, 31 Jul 2001 17:45:47 -0700

> old LSP it's neighbors send it back.

well, isn't the idea of a 'roll-over' that you accept both keys for a period
of time? And during this period of time all LSPs with the old key should
time out and any other possible information authenticated by this key
should also vanish so obviously roll-over period >> LSP lifetime.
Also you must be able within ISIS to hold both keys
and when you receive a piece of information, try new key and then old
key. Given that, what's the problem exactly ?

    -- tony