Subject: Re: [Idr] proposed additional text

From: Yakov Rekhter <[email-masked]>
Date: Tue, 18 May 2004 07:34:03 -0700

Folks,

How about if we'll replace

   Because the mechanism defined in RFC 2385 does not
   provide peer-entity authentication, these connections are still
   subject to some forms of replay attacks.

with the following

   Because the mechanism defined in RFC 2385 does not provide
   peer-entity authentication, these connections are still subject
   to some forms of replay attacks. Changing key more frequently
   (e.g., once a week or more) reduces the probability of such
   attacks.  Determining whether such attacks could happen in
   practice is outside the scope of this document.

Yakov.

_______________________________________________
Idr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/idr

---

From: Jeffrey Haas <[email-masked]>
Date: Tue, 18 May 2004 10:47:01 -0400

Yakov,

Estimations such as these are based on current levels of traffic
on the BGP session.  While this estimate is good for now, will it
be good later on?  My suspicion is no, although it will still probably
be in the window of a day or more for the next decade.

IMO, we should simply recommend good keying practices, not talk
about the rekeying interval (or leave to another document) and
simply note the vulnerability.  If we feel the need to say that
we consider this to be a small one as of the time of this writing,
that's fine.

-- 
Jeff Haas 
NextHop Technologies

---

From: Jeffrey Haas <[email-masked]>
Date: Tue, 18 May 2004 10:47:01 -0400

Yakov,

-- 
Jeff Haas 
NextHop Technologies