Subject: OSPF cryptographic authentication keying

From: Eastlake III Donald-LDE008 <[email-masked]>
Date: Tue, 13 Aug 2002 14:06:10 -0400

Hi,

I have a couple of questions about how keying is established for OSPF
cryptographic authentication:

First of all, which may be a stupid questions, I have the impression the
keying is essentially on a pairwise basis, rather than a key being shared
among all the entities in an area. Is that correct?

Second, how are these keys normally established in today's operational
world? I realize this is a bit outside of the scope of OSPF, but do people
use manual entry, SNMP, some negotiation framework like ISAKMP, or what?

Thanks,
Donald

Donald E. Eastlake 3rd, +1-508-851-8280 (voice), +1-508-851-8507 (fax)
Motorola, MS: M2-450, 20 Cabot Boulevard, Mansfield, MA 02048 USA

---

From: Mukesh Gupta <[email-masked]>
Date: Tue, 13 Aug 2002 11:44:51 -0700

> cryptographic authentication:

I am assuming that you are talking about OSPFv2.

> among all the entities in an area. Is that correct?

To my knowledge, No. It is not correct. The keys are shared between all the
entities in an area and they are not on a pairwise basis. Using pairwise keys
in the multicast environment will not work.

> use manual entry, SNMP, some negotiation framework like ISAKMP, or what?

I think, most of the implementations use manual entry. ISAKMP wouldn't be easy
to use in the multicast environment OSPF uses. Key negotiation mechanisms for
multicast are still being explored.

regards
Mukesh

--
******************************************************************
Work fascinates me. I can look at it for  hours !
******************************************************************
Mukesh Gupta
Phone: (650) 625-2264
Cell : (650) 868-9111
http://www.iprg.nokia.com/~mgupta
******************************************************************

---

From: Acee Lindem <[email-masked]>
Date: Wed, 14 Aug 2002 10:12:00 -0400

Mukesh Gupta wrote:

> entities in an area and they are not on a pairwise basis.

Mukesh,

Keys need only be shared on a per-interface basis. The specification of
authentication type per interface (as opposed to per area) was introduced
between RFCs 1583 and 2178.

Thanks,
Acee

> Using pairwise keys

--
Acee

---

From: Mukesh Gupta <[email-masked]>
Date: Wed, 14 Aug 2002 07:22:49 -0700

> between RFCs 1583 and 2178.

Oops !! my bad. I was focussing on the keys being shared between multiple neighbours
and made a wrong statement. Yeah, the keys are shared on a per-interface basis.

Thanks for correcting me.

regards
Mukesh