Subject: Re: OSPF WG Minutes

From: Vishwas Manral <[email-masked]>
Date: Mon, 15 Aug 2005 21:34:42 -0700

Hi Acee,

> Acee: In practice, for OSPFv2 the sequence numbers are not monotically
> increasing; Usage of router's clock for cryptographic sequence number 
> generation reduces the chance for replay attacks across restarts. 
> ?: OSPF spec does not say it ...
Acee, what I meant was that although the OSPF spec does not state that
we need to use clocks. 

I think the vulnerabilities draft is the right place to state the
problems that can happen if we do not use a clock (or something
equivalent which increments even when a system goes down).

Another issue is that even if the sender uses clock for the "sequence
number" and goes down, all the packets of a previous session can still
be replayed by another router. So the chance of replay attacks is still
there.

Thanks,
Vishwas
-----Original Message-----
From: Mailing List [mailto:[email-masked]] On Behalf Of Acee
Lindem
Sent: Monday, August 15, 2005 7:50 PM
To: [email-masked]
Subject: OSPF WG Minutes

Attached are the minutes from the Paris OSPF WG meeting. Thanks to
Dimitri for taking them.

Acee

---

From: Ajay Thakur <[email-masked]>
Date: Tue, 16 Aug 2005 10:12:50 +0530

Hi all,
I have some more queries in OSPF  - NSSA area.

Suppose I am summarizing type-7 LSAs.  In this case while generating 
type-5 lsa we follow section 4.1 of rfc 1587,

e.g.
1>  If none of the LSA's  LS-Id matches to my summary-address range but 
LS-Id falls under configured summary address range, then we generate 
type-5 as per  rfc 1587 -section 4.1 (2)
and

2> If my LSA has LS-Id equal to summary address range then  we  generate 
type-5 lsa as per rfc 1587 section-4.1(1)

Now my question is ,
What happens if ospf database has one LSA with LS-Id matches to my 
summary-address range and some LSAs with LS-Id falling under 
summary-address range.  Then in this case what type of metric or 
path-type we should set in the type-5 lsa?
Need your help,
Thanks,
with regards
ajay

---

From: sujay <[email-masked]>
Date: Tue, 16 Aug 2005 10:45:57 +0530

As there is now a single type-5 lsa to represent both the exact match as
well as all
the LS-id's falling under the summary-address range, in my opinion the
metric/path-type etc. 
should follow section 4.1(2).
Regds,
~Sujay

-----Original Message-----
From: Mailing List [mailto:[email-masked]] On Behalf Of Ajay
Thakur
Sent: Tuesday, August 16, 2005 10:13 AM
To: [email-masked]
Subject: NSSA summarization

Hi all,

e.g.

Now my question is ,

---

From: Acee Lindem <[email-masked]>
Date: Tue, 16 Aug 2005 07:45:59 -0400

Vishwas Manral wrote:
Hi Vishwas,

>Acee, what I meant was that although the OSPF spec does not state that
Ok - got the update.

>equivalent which increments even when a system goes down).
Ok. I was just state that in practice it is not as easy to exploit as it 
appears.

>be replayed by another router. So the chance of replay attacks is still
You don't mean all the packets do you? You mean all the packets with the 
last sequence number. So,
if the last packet was a hello, the session could be kept up indefinitely.

Thanks,
Acee

---

From: Paul Jakma <[email-masked]>
Date: Tue, 16 Aug 2005 19:37:28 +0100

On Tue, 16 Aug 2005, Acee Lindem wrote:

> You don't mean all the packets do you? You mean all the packets 
> with the last sequence number.

Nah, /all/ packets. 'Kick' the victim router hard enough so it stays 
down. Then wait for the dead-interval and the victim's peers 
will/should forget the sequence number. Then you can replay 
everything.

Though, not sure how you'd get past database exchange, as the 
router-being-spoofed need not use same state (DD sequences, LSA 
seqnum's), etc.

Seems theoretical to me too. ;)

regards,
-- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
Nadia Comaneci, simple perfection.
 		-- '76 Olympics