Subject: Re: [karp] Security Extension for OSPFv2 when using Manual Key Management

From: Sam Hartman <[email-masked]>
Date: Tue, 01 Mar 2011 09:18:39 -0500

Hi.
Thanks for pointing out that I failed to consider packet hashing delays
as a function of packet size.
I feel kind of silly.

I think the highest order of business is figuring out whether we want an
approach based on exchanging nonces to prove freshness or an approach
based on nonvolatile boot counts.  To me, the biggest question there is
what attacks are possible if you cannot guarantee freshness.

As I've said, I'm reasonably sure you can get an adjacency to 2-way
state.  However that doesn't seem to be very useful as an attack.

If we do think freshness is important, I now agree it makes sense to
consider an option that involves challenge packets.  (It might also be
possible to trim the hello information in our current proposal so that
in steady state the hello sizes do not increase significantly.)

Thanks again for working with me until I understood your point.