Subject: Re: [RPSEC] Potential requirements

From: [email-masked]
Date: Tue, 12 Nov 2002 16:48:58 -0500 (EST)

Russ said:

>Okay, so let's say that BGP is a policy propogation mechanism, so
>you _could_ stretch it in this case. But can you stretch it in
>the case of OSPF, IS-IS, PIM, etc? In other words, as the same
>question: Could the authorization to advertise a certain
>destination as reachable through this device be a part of the
>OSPF protocol itself?

OSPF and IS-IS are link state, so they are different animals.  But in
these protocols, a router floods information about its links to
everywhere.  Nothing in either protocol prevents a router from sending
out information about another router's links (by getting the source
field in the link info wrong, for example).  (Routers everywhere
construct SPF trees from this incorrect data and the fun begins.)  So
in that sense, in OSPF and IS-IS, there is an assumption about the
authorization to speak for a link.  Radia Perlman's work talks about
how to protect this authorization assumption in link state protocols
and RFC2154 talks about how to do it for OSPF in particular.

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Tue, 12 Nov 2002 20:26:43 -0500 (EST)

> Radia Perlman's work talks about how to protect this
> authorization assumption in link state protocols and RFC2154
> talks about how to do it for OSPF in particular.

Actually, according to RFC2154:

The basic idea of this proposal is to add digital signatures to
OSPF LSA data, distribute certified router information and keys,
and use a neighbor-to-neighbor authentication algorithm (like
keyed MD5) to protect local protocol exchanges.

Just because a device signs something as actually originating
from the device itself, it doesn't prove the device is authorized
to transmit that reachability information. In other words, my
daughter can sign to use my credit card. I now know who used my
credit card, but nothing in that signature indicates she is
actually authorized to use it.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

---

From: Stephen Kent <[email-masked]>
Date: Wed, 13 Nov 2002 11:41:29 -0500

>actually authorized to use it.

Signing is useful as means of detecting the source of bogus data when 
that data is broadcast, and one wants to rule out modification of the 
data by intermediaries. You are correct that this is different from 
signing data where authorization data is bound to the key used to 
verify signatures, and thus one can ascertain the authorization of 
the signer. However I think Sandy pointed out that in this case both 
apply.

Steve