Subject: RE: [Isis-wg] draft-ietf-isis-hmac-03.txt

From: Jeff Parker <[email-masked]>
Date: Mon, 2 Jul 2001 18:38:02 -0400

Tony -

Looks good.  Two minor nits.  First, a quote

      An implementation  that  implements  HMAC-MD5  authentication  and
   receives  HMAC-MD5 Authentication Information MUST discard the PDU if
   the Authentication Value is incorrect.

      An implementation MAY include HMAC-MD5 Authentication  Information
   in  PDUs even if it does not fully implement HMAC-MD5 authentication.
   This allows an implementation to generate authentication  information
   without   verifying   the  authentication  information.   This  is  a
   transition  aid  for   networks   in   the   process   of   deploying
   authentication.

This indicates a difference between "implementing" and "fully implementing"
and seems to contradict the "MUST discard" from first paragraph.  
It may be clearer if you talk about a protocol configuration that allows a 
"transition mode" or something along those lines.   

The text suggests that you run the checksum over the PDU.
A brief look at the use of the term PDU in 10589 includes usage where 
the header is part of the PDU: you should make clear that you do not
checksum the header.  

- jeff parker
- axiowave networks
- Ambivalent?  Well, yes and no.   
  
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Tony Li <[email-masked]>
Date: Mon, 2 Jul 2001 17:22:46 -0700

Jeff,

Thanks for the comments.

 |       An implementation  that  implements  HMAC-MD5  authentication  and
 |    receives  HMAC-MD5 Authentication Information MUST discard the PDU if
 |    the Authentication Value is incorrect.
 | 
 |       An implementation MAY include HMAC-MD5 Authentication  Information
 |    in  PDUs even if it does not fully implement HMAC-MD5 authentication.
 |    This allows an implementation to generate authentication  information
 |    without   verifying   the  authentication  information.   This  is  a
 |    transition  aid  for   networks   in   the   process   of   deploying
 |    authentication.
 | 
 | This indicates a difference between "implementing" and "fully implementing"
 | and seems to contradict the "MUST discard" from first paragraph.  
 | It may be clearer if you talk about a protocol configuration that allows a 
 | "transition mode" or something along those lines.   

I've reworded the second paragraph to read:

   An implementation MAY have a transition mode where it includes HMAC-MD5
Authentication Information in PDUs but does not verify the HMAC-MD5
authentication information.  This is a transition aid for networks in the
process of deploying authentication.

 | The text suggests that you run the checksum over the PDU.
 | A brief look at the use of the term PDU in 10589 includes usage where 
 | the header is part of the PDU: you should make clear that you do not
 | checksum the header.  

Ummm... to be specific here, the intent is that you run the checksum over
the IS-IS PDU, including the fixed length header.  But not the link layer
header.  Is that not what you understood from the existing text?  I've
tried to reinforce this by specifically mentioning the "IS-IS PDU" vs. the
"PDU".

Tony