Subject: Some authentication problems with LLS?

From: Yamate Keiichirou <[email-masked]>
Date: Sat, 15 Jun 2002 16:50:47 +0900

Hi.

  I want to know how link-local signaring
(draft-nguyen-ospf-lls-00.txt) prevents some reply attacks. Please
teach me.

  In assumption that there are two routers using cryptgraphic
authentication and supporting LLS and RS-bit, and an attacker's host
(called "Host") on same link, when one router is restarted (called
"Restart Router"), Restart Router will sends Hello with RS-bit set to
(a) neighboring router (called "Neighbor").

  Where sending hello, Restart Router generates both of Hello itself
and LLS that has RS-bit set with message digest and cryptgraphic
sequence number, since the link required to transmit OSPF packets with
cryptgraphic authentication.

  However, Restart Router shall not know what sequence number the
Restart Router's previous incarnation sent (on other hand, it SHOULD
be nonvolatile stored in hitless-restart).  I think two problems at
the time.

  One is, Restart Hello reply attack.

  Assumption of the cryptgraphic sequence number is "1" at (re)start,
Neighbor SHOULD be ignore the Restart Router's Hello because Hello has
little cryptgraphic sequence number than accepted previously. If Hello
was ignored, the adjacency will be reset in the result. And If Hello
was accepted against reversed sequence number, it is allow to Host to
attack simply replying the heard Hello with RS-bit set and it will
accepted at Neighbor in any time.

  Another is, LLS block reply attack attached to Neighbor's Hello with
same cryptgraphic sequence number.

  Whatever sequence number is, all LLS blocks in any Hellos are
authenticated only with cryptgraphic sequence number. It is possible
that Host store any LLC blocks attached to Hellos, and when Hello that
has same cryptgraphic sequence number as one of LLSs stored, there is
a potential that Host sends receiving Hello with LLS unassociated but
same sequence number.

Thank you.