Subject: [OSPF] OSPFv3 Authentication

From: Ed Jankiewicz <[email-masked]>
Date: Tue, 23 Sep 2008 18:14:20 -0400

I am not an active follower of this list but have a question.  Please 
reply off-list directly to [email-masked] unless your response 
would be of interest to the list.

What (if any) current initiatives are there that would support automated 
key exchange for OSFPv3 authentication?  RFC 4552 relies upon pre-shared 
secret keys for generating message digest, but some of my constituents 
have issues with manual generation, distribution and configuration of 
keys in their IPv6 network deployment.  Is any of the current work on 
IKE revisions applicable, any work being done in your working group, or 
do you know of any OSPF-specific solution being developed somewhere else?

Thanks.

-- 
Ed Jankiewicz - SRI International
Fort Monmouth Branch Office - IPv6 Research 
Supporting DISA Standards Engineering Branch
732-389-1003 or  [email-masked] 

_______________________________________________
OSPF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ospf

---

From: Acee Lindem <[email-masked]>
Date: Thu, 25 Sep 2008 10:23:57 -0400

Hi Ed,

We've had discussions on the alternatives for automated distribution  
of keys. One question - if you could use IKEv2, how would you  
authenticate the initial exchange to establish the IKE SA? Would you  
be opposed to using a manually distributed key here? IGP routing MUST  
NOT be dependent on certificates (unless, of course, every router  
using IPsec has a certificate server on a directly attached network).

Acee

On Sep 23, 2008, at 6:14 PM, Ed Jankiewicz wrote:

> I am not an active follower of this list but have a question.   
> Please reply off-list directly to [email-masked] unless your  
> response would be of interest to the list.
>
> What (if any) current initiatives are there that would support  
> automated key exchange for OSFPv3 authentication?  RFC 4552 relies  
> upon pre-shared secret keys for generating message digest, but some  
> of my constituents have issues with manual generation, distribution  
> and configuration of keys in their IPv6 network deployment.  Is any  
> of the current work on IKE revisions applicable, any work being  
> done in your working group, or do you know of any OSPF-specific  
> solution being developed somewhere else?
>
> Thanks.
>
> -- 
> Fort Monmouth Branch Office - IPv6 Research Supporting DISA  
> Standards Engineering Branch