Subject: [RPSEC] Using IPSec for Routing Protocols

From: Sandhya Chawla <[email-masked]>
Date: Thu, 4 May 2006 05:15:21 +0100 (BST)

Hi,
   
  I have a doubt.
   
  Why are we working on providing security at each routing protocol (application layer)? Why cant we simply use IPSEC for this?
   
  Will not AH in the transport mode provide data integrity and security for all the routing protocols (basically the IP payload) ? If confidentiality is required then one can use ESP.
   
  So, what is it that i am missing or i dont understand, because of which we in IETF are working on providing security/authentication features in each protocol besides already having IPSec.
   
  Regards,
  Sandhya

---------------------------------
 Yahoo! India Answers: Share what you know. Learn something new. Click here

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 4 May 2006 09:59:06 +0200

On Thu, May 04, 2006 at 05:15:21AM +0100,
 Sandhya Chawla <[email-masked]> wrote 
 a message of 50 lines which said:

> Why are we working on providing security at each routing protocol
> (application layer)? Why cant we simply use IPSEC for this?

Wild guess from a non-expert: because IPsec only provides channel
security, not data security. For instance, if I have a BGP connection
with a peer, I can use IPsec and therefore be sure that the peer is
really what it says it is. But what does it buy me when the peer
announces a route? How can I be sure that he is entitled to announce
this route? 

(Analogy: showing me your passport can convince me that you are indeed
Sandhya Chawla. But it does not make any difference when you tell me
that Om Prakash Chautala is an honest man or not: I still have to
check the information.)

For the same reason, IPsec does not make the DNS safer and we need
DNSsec.

---

From: Sandhya Chawla <[email-masked]>
Date: Thu, 4 May 2006 09:26:05 +0100 (BST)

Hi Stephane,

> security, not data security. For instance, if I have a BGP connection

We could use ESP will null encryption (null cipher). Using NULL as we really dont want to provide
any confidentiality. We only want to authenticate the sender and want to make sure that no one
mangles the packet in between.

> announces a route? How can I be sure that he is entitled to announce

Yes, i understand the need for SO-BGP and S-BGP. What about the IGPs? We would perhaps not want to
go in for the complexity of issuing certificates, etc for IGPs. Would we?

If not, then why cant we simply use IPSEC to protect and auth my IGP data?

I understand that IPSEC works best for, and is perhaps currently defined only for unicast traffic.
Is this the reason because of which we cant use IPSEC for IGPs (OSPF)?

Regards,
Sandhya

> For the same reason, IPsec does not make the DNS safer and we need

__________________________________________________________ 
Yahoo! India Answers: Share what you know. Learn something new. 
http://in.answers.yahoo.com

---

From: Acee Lindem <[email-masked]>
Date: Thu, 04 May 2006 07:05:38 -0400

Sandhya,
See inline.

>go in for the complexity of issuing certificates, etc for IGPs. Would we?
I would hope not. Though there have been experiments in this area.

>If not, then why cant we simply use IPSEC to protect and auth my IGP data?
There have been some challenges in using IPSec but the draft should be 
published soon.

http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-08.txt

Work is underway to provide the IPSec for OSPFv2 as well.

Acee

---

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 4 May 2006 05:25:16 -0700

Hi Acee,

One reason we do not use IPsec is that we do not support multicast well in
IPsec. I think the way it is used in OSPFv3 is itself a hack. Also in the
end of it we are still using manual keying as well as only authentication so
still the same as for the rpotocols.

Stephen Kent would probably have the details of it.

Thanks,
Vishwas

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 04 May 2006 11:42:01 -0700

At 05:25 AM 5/4/2006, Vishwas Manral wrote:
>Hi Acee,
>
>One reason we do not use IPsec is that we do not support multicast 
>well in IPsec.

This is news to me and probably to many folks in MSEC.  Please take a 
look at the work underway in that group.

regards,
Lakshminath

>  I think the way it is used in OSPFv3 is itself a hack. Also in the 
> end of it we are still using manual keying as well as only 
> authentication so still the same as for the rpotocols.
>
>On 5/4/06, Acee Lindem <<mailto:[email-masked]>[email-masked]> wrote:
>Sandhya,
>See inline.
>Sandhya Chawla wrote:
>
> >Hi Stephane,
> >
> >--- Stephane Bortzmeyer < 
> <mailto:[email-masked]>[email-masked]> wrote:
> >
> >
> >
> >> Sandhya Chawla 
> <<mailto:[email-masked]>[email-masked] > wrote
><http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-08.txt>http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-08.txt
>
> ><http://in.answers.yahoo.com>http://in.answers.yahoo.com
> >
> ><mailto:[email-masked]>[email-masked]
><mailto:[email-masked]>[email-masked]

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 04 May 2006 11:50:50 -0700

Hi,

Stephane makes an important point and asks the question of whether 
channel security (doesn't necessarily mean encryption; an integrity 
protected channel is also "secure," with the property that a third 
party can't modify data without detection) is sufficient.  I'd like 
to hear others' take on what the requirements are.

So, Sandhya, are you saying that integrity protection in transit is 
the only requirement?  And, are you saying that there is no need for 
the recipient to be able to verify whether the claimed route or 
reachability information is in fact correct?  Put another way, do we 
care to mitigate the impact of a compromised router?

regards,
Lakshminath

---

From: Acee Lindem <[email-masked]>
Date: Thu, 04 May 2006 15:12:51 -0400

Vishwas Manral wrote:

> well in

Hi Vishwas,

Irrespective of the limitations, I belive what is defined will
provide for a base for further enhancement. If there were a burning 
requirement
for improvement, one could relegate OSPFv3 to only point-to-point and
point-to-multipoint networks types and use dynamic keying and reply
protection.

Thanks,
Acee

>> >any confidentiality. We only want to authenticate the sender and 
>> want to
>> make sure that no one
>> >Yes, i understand the need for SO-BGP and S-BGP. What about the 
>> IGPs? We
>> would perhaps not want to
>> >I understand that IPSEC works best for, and is perhaps currently 
>> defined
>> only for unicast traffic.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 5 May 2006 10:55:57 +0200

On Thu, May 04, 2006 at 11:50:50AM -0700,
 Lakshminath Dondeti <[email-masked]> wrote 
 a message of 77 lines which said:

> reachability information is in fact correct?

The charter of the WG does not mention it but the ID
draft-ietf-rpsec-routing-threats-07.txt is very clear that
falsification of routes by a router, even authentified, is a
problem. Therefore, IPsec cannot be the only approach in this WG.

See section 4.5

---

From: "Vishwas Manral" <[email-masked]>
Date: Fri, 5 May 2006 05:02:53 -0700

Hi Lakshminath,

I was trying to refer to the conversation on the SAAG list of which you were
a part.

Thanks,
Vishwas

On 5/4/06, Lakshminath Dondeti <[email-masked]> wrote:
> > want to make sure that no one
> > IGPs? We would perhaps not want to
> ><http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-08.txt>
> > defined only for unicast traffic.