Subject: Re: Auth Data Length

From: Vernon Schryver <[email-masked]>
Date: Tue, 9 Jun 1998 07:39:28 -0600 (MDT)

> From: Nariyasu Hirata <[email-masked]>
> To: [email-masked]

> I need a clarification about the Auth Data Length octet for the MD5
> authentication. Methinks RFC 2082 says this octet is the value 16, but I
> found that some major router uses the value 16 instead.
> Is this value count the Address Family and Authentication Type fields
> along with the Authentication Data trailer?

I do not understand.  Should one of the values "16" in that message
be something else?

My code (in FreeBSD, NetBSD, OpenBSD, and IRIX) puts 16 or the length of
the MD5 hash into the twelth byte.  I paragraph "(4)" of section 3.1 of
RFC 2082 as saying the value should be 16.

What other implementations (major or otherwise) of RIPv2 MD5 authentiation
have you found to test with, particularly that use something other than
16?  Years ago I gave up nagging people inside a very major router vendor
to arrange private interoperation test of their new code to look for
exactly this kind of issue.  I've always been worried that my personal
reading of the MD5 RIPv2 draft might have been wrong.

Vernon Schryver    [email-masked]

---

From: Nariyasu Hirata <[email-masked]>
Date: Wed, 10 Jun 1998 09:57:45 +0900

> > found that some major router uses the value 16 instead.
Alas, I had to say that one uses the value 20 instead.

> reading of the MD5 RIPv2 draft might have been wrong.
My reading is the same as you, but at least one major vender uses a
different value. You will find the name of the vender at the Authors'
section of RFC 2082.

- Hirata

---

From: "C. Harald Koch" <[email-masked]>
Date: Tue, 9 Jun 1998 21:24:59 -0400

> Alas, I had to say that one uses the value 20 instead.

Sounds like SHA/SHA1; the digest output for that algorithm is 20 bytes instead
of 16.

Or it could be a bug. :-)

-- 
Harald Koch <[email-masked]>

"Madness takes its toll. Please have exact change."
		-Karen Murphy <[email-masked]>

---

From: Nariyasu Hirata <[email-masked]>
Date: Wed, 10 Jun 1998 10:40:16 +0900

> Or it could be a bug. :-)
Ignoring the authentication data length, they passed MD5 authentication.
I do not think there happens accidental collisions of MD5 and SHA
checksums. :-)

- Hirata