Subject: Re: [isis-wg] comment on hmac-03

From: Nick Amato <[email-masked]>
Date: Wed, 1 Aug 2001 00:24:07 -0400

On Tue, Jul 31, 2001 at 08:50:02PM -0700, Naiming Shen wrote:
>  ]
>  ]At time X, both A and B switches auth key from key1 into key2, and A's
>  ]ISIS process restarted. A and B then re-establish the adjacency with
>  ]the key2, they can also exchange the SNPs using the key2, there is no
>  ]problem of that. A now has a LSP starts from seq# of 1. when A sends
>  ]this LSP to B, B rejects this, and send the A's old LSP back to A(with
>  ]the key1). If B does not have multiple-key implemented or B timedout
> 
> typo here       ^ (should be A)                             ^ ( A also )
> 
>  ]the key1 too soon, then the old LSP with key1 is rejected because of
>  ]failing authentication. B will not get A's new LSP until this old LSP
>  ]of A timed out.
> 

I agree with this example (LSPs use the authentication of the originator
rather than the transmitter of the LSP PDU).

Section 2.1 should probably indicate, like your example, the problem
exists if the router does not implement multiple keys or the old
key is timed out too quickly or forgotten rather than after the
router restarts, just for clarity.  The router may remember its old
key if the configuration was in non-volatile storage. :)

Nick
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Naiming Shen <[email-masked]>
Date: Tue, 31 Jul 2001 22:33:38 -0700

]
 ]I agree with this example (LSPs use the authentication of the originator
 ]rather than the transmitter of the LSP PDU).
 ]
 ]Section 2.1 should probably indicate, like your example, the problem
 ]exists if the router does not implement multiple keys or the old
 ]key is timed out too quickly or forgotten rather than after the
 ]router restarts, just for clarity. 

Agreed. It would be nice to spell it out. Anyway, it should be taken
care of at the protocol implementation level. Use one key or multiple keys,
how long to keep the keys, those are configuration issues.

 ]The router may remember its old
 ]key if the configuration was in non-volatile storage. :)

I said "ISIS process restarted", not router restarted, so nvram is
not needed here:-)

thanks.

 ]
 ]Nick

- Naiming