Subject: Re: [mpls] mpls Digest, Vol 78, Issue 37

From: Lamberto Sterling <[email-masked]>
Date: Tue, 26 Oct 2010 20:31:38 +0800

Hi,
+1, I fully agree with Vishwas. No much benefit of hello security.

Lamberto

>
> Message: 3
> Date: Mon, 25 Oct 2010 21:21:07 -0700
> From: Vishwas Manral <[email-masked]>
> Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security
> To: Vero Zheng <[email-masked]>
> Cc: mpls <[email-masked]>
> Message-ID:
>        <[email-masked]>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Hi Vero/ Mach,
>
> I had thought of this in some detail earlier.
>
> My reasoning is the follows. Thinking of what we loose if we do not
> authentication in LDP Hellos. We will go ahead and try to establish
> TCP sessions (which will anyway fail as TCP authentication is there).
>
> If we think of what we loose when adding the Authentication in Hellos,
> it is using additional CPU capacity and an additional mechanism which
> is an overhead. There is nothing to loose in case of replays as the
> TCP messages are authenticated and session will be dropped even if
> Hellos are retransmitted.
>
> That said I had added a section for support of IPsec for LDP in the
> IPv6 draft (which we dropped as it was slightly out of context in the
> draft). You may want to consider that.
>
> Thanks,
> Vishwas
>
> 2010/10/24 Vero Zheng <[email-masked]>:
> > Hi Folks,
> >
> > We would like to hear you opinion on LDP security.
> >
> > Unlike all other LDP messages, the Hello messages are sent using UDP?not
> > TCP.
> > This means that they cannot benefit from the security?mechanisms
> available
> > with TCP.
> > [RFC5036] does not provide any?security mechanisms for use with Hello
> > messages except to note that?some configuration may help protect against
> > bogus discovery events.
> >
> > Do we need to allow the use of different keys from the ones used on the
> TCP
> > session?
> >
> > We have submitted a new?"LDP Hello Cryptographic Authentication" draft.
> In
> > this draft, we introduce a new Cryptographic Authentication TLV?which is
> > used in LDP Hello message as an optional parameter.
> > An LSR can be configured to?only accept Hello messages from specific
> peers
> > when authentication?is in use.
> > The URL for it is:
> > http://tools.ietf.org/id/draft-zheng-mpls-ldp-hello-crypto-auth-00.txt
> > Looking forward to your comments.
> >
> > BR,
> > Mach and Vero
> > _______________________________________________
> > mpls mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/mpls
> >
> >
>
>