Subject: [pim] Security Issues

From: "Salekul Islam" <[email-masked]>
Date: Sat, 5 Apr 2003 11:27:23 -0500

Hi,

I have two questions and I am expecting someone will answer these questions.

1. In PIM-SM Spec it is said about authenticating link-local messages that "The IPsec [12] transport mode using the Authentication Header (AH) is the recommended method to prevent the above attacks against PIM". These link-local messages are sent and received by PIM routers. But I have found in IPsec document that trasnsport mode can be used between two hosts only. If we want to use IPsec between two gateways(routers) we have to implement IPsec tunnel mode. In that case how can we implement trasnport mode here?

2. In security section it is receommended that one SA should be used to protect all the link-local messages. My point is that nothing is mentioned about how to protect multicast data. As far my understanding we need another SA among the sender(s) and receiver(s) to protect mulicast data. When a sender sends data to multicast group it will use the later SA and only the receivers will be able to decrypt the data (not the intermediate routers). Intermediate routers will only by-pass these data packets.

Thanks for your consideration and waiting for someone response.

Salekul

---

From: Marshall Eubanks <[email-masked]>
Date: Sat, 5 Apr 2003 14:09:04 -0500

Hello;

I will take a shot at this.

On Saturday, April 5, 2003, at 11:27 AM, Salekul Islam wrote:

> 1. In PIM-SM Spec it is said about authenticating link-local messages 
> that "The IPsec [12] transport mode using the Authentication Header 
> (AH) is the recommended method to prevent the above attacks against 
> PIM". These link-local messages are sent and received by PIM routers. 
> But I have found in IPsec document that trasnsport mode can be used 
> between two hosts only. If we want to use IPsec between two 
> gateways(routers) we have to implement IPsec tunnel mode. In that case 
> how can we implement trasnport mode here?
>

My understanding is that in this use of AH for ttl = 1 communications 
between
PIM routers, the routers are the end hosts. (This is not to protect a 
flow from
end to end, only on each hop independently.)

>  
> 2. In security section it is receommended that one SA should be used to 
> protect all the link-local messages. My point is that nothing is 
> mentioned about how to protect multicast data. As far my understanding 
> we need another SA among the sender(s) and receiver(s) to protect 
> mulicast data. When a sender sends data to multicast group it will use 
> the later SA and only the receivers will be able to decrypt the data 
> (not the intermediate routers). Intermediate routers will only by-pass 
> these data packets.

Protection of one to many or many to many group communications is not 
trivial and is not fully solved.
It is also not part of the PIM charter. However, there is active work 
going on in the arena, and solutions for pieces of the puzzle, such as 
TESLA; you should look at the MSEC and GSEC charters and the drafts 
referenced there.

http://www.ietf.org/html.charters/msec-charter.html
http://www.irtf.org/charters/gsec.html

                                  Regards
                                  Marshall Eubanks

T.M. Eubanks
Multicast Technologies, Inc.
e-mail : [email-masked]
http://www.multicasttech.com

  Our New Multicast Workshop :
http://www.multicasttech.com/workshop