Subject: [mpls] [MPLS] HELP: Need your opinion on LDP security

From: Vero Zheng <[email-masked]>
Date: Mon, 25 Oct 2010 12:10:39 +0800

Hi Folks,

We would like to hear you opinion on LDP security. 

Unlike all other LDP messages, the Hello messages are sent using UDP not TCP. 
This means that they cannot benefit from the security mechanisms available with TCP. 
[RFC5036] does not provide any security mechanisms for use with Hello messages except to note that some configuration may help protect against bogus discovery events. 

Do we need to allow the use of different keys from the ones used on the TCP session?

We have submitted a new "LDP Hello Cryptographic Authentication" draft. In this draft, we introduce a new Cryptographic Authentication TLV which is used in LDP Hello message as an optional parameter. 
An LSR can be configured to only accept Hello messages from specific peers when authentication is in use. 
The URL for it is: http://tools.ietf.org/id/draft-zheng-mpls-ldp-hello-crypto-auth-00.txt

Looking forward to your comments.

BR,
Mach and Vero

---

From: Eric Rosen <[email-masked]>
Date: Mon, 25 Oct 2010 16:35:28 -0400

I have a few questions.

   "An MD5 digest or a SHA1/SHA2 hash is calculated over the entire LDP 
    Hello packet."

It's not clear just what is meant by "the entire LDP Hello packet".
Presumably this doesn't include the TTL field in the IP header of the LDP
Hello packet.  Does "the entire LDP Hello packet" mean the UDP packet
following the end of the IP header, or perhaps an "IP  pseudoheader"
followed by the entire UDP packet?

   "A sequence number is also carried in each packet to help avoid replay
   attacks."

Should something be said about how to choose the initial sequence number?
Probably it shouldn't start with zero every time.

   "For most of the authentication scheme in use, if the received 
   sequence number lies outside of the range of last sequence number 
   received to last sequence number received +(Hello Hold Time/Hello 
   Interval) inclusive, the received packet MUST be discarded."

How does one know what the peer's Hello Interval is?   If the peer sends
Hellos more frequently than expected, and some of them get lost, the
sequence number range check could fail.  This would then cause the LDP
session to die.

I don't think one wants to manage the LDP/Hello security separately from the
LDP/TCP security, but the draft doesn't seem to create any connection
between them.

I am certainly not a security expert, but I'm a bit puzzled as to why the
authentication mechanisms here seem to be a lot simpler than those in RFC
5925 (TCP-AO) or RFC 5709 (OSPFv2 HMAC-SHA).

---

From: "Mallette, Edwin" <[email-masked]>
Date: Mon, 25 Oct 2010 16:35:58 -0400

Vero,

I cannot think of a case where I would utilize a different key to secure the hellos than the key used to secure the TCP session.  That being said, I also cannot think of a specific reason to preclude this functionality.

Ed

From: [email-masked] [mailto:[email-masked]] On Behalf Of Vero Zheng
Sent: Monday, October 25, 2010 12:11 AM
To: mpls
Subject: [mpls] [MPLS] HELP: Need your opinion on LDP security

Hi Folks,

BR,
Mach and Vero

________________________________
CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

---

From: Vero Zheng <[email-masked]>
Date: Tue, 26 Oct 2010 12:05:56 +0800

Hello Eric,

Thanks for the questions. Please see in-line.

Thanks
Vero

--------------------------------------------------
From: "Eric Rosen" <[email-masked]>
Sent: Tuesday, October 26, 2010 4:35 AM
To: "Vero Zheng" <[email-masked]>
Cc: "mpls" <[email-masked]>
Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security

> followed by the entire UDP packet?

Vero-> You are right that "the entire LDP Hello packet" is not clear enough. By saying "the entire LDP Hello packet", we meant the LDP header + Hello message. We will update this in the later version.

> Probably it shouldn't start with zero every time.

Vero-> What about saying "How to choose the intitial sequence number is a local manner, it depends on the different implentation. It is NOT RECOMMENDED that it starts with zero every time. " 

> sequence number range check could fail.  This would then cause the LDP

Vero-> The range specified for acceptable sequence numbers maps into the largest number of Hellos that can be lost before the adjacency is deleted. (Hello Hold Time/Hello Interval) here is only a rough estimate at the number of lost packets before the hello adjacency is deleted anyhow. When implemented, the value could be set to a explicit number, e.g 3, without the need of knowing the peer's Hello interval. Its possible to use an additional multilplier, e.g.*3, to give more room to avoid accidental hello lost, which provides more flexibility on implementaion (at the cost of a increase of window size through which a packet could be replayed). We could make this more clear in the later version.

> LDP/TCP security, but the draft doesn't seem to create any connection

Vero-> Certainly using the same key(s) for LDP Hello/TCP security is easier in terms of maintenance and operation, this is also our preference. We would also like to hear the WG's opinions regarding this.
> 5925 (TCP-AO) or RFC 5709 (OSPFv2 HMAC-SHA).

Vero-> Besides the autentication mechanism itself, RFC5927 also describes a lot how TCP-AO interacts with TCP. That may the reason why the LDP Hello authentication mechanisms here seems more simpler:)

---

From: Vero Zheng <[email-masked]>
Date: Tue, 26 Oct 2010 12:13:44 +0800

Hi Ed,

Thanks for your comment.
As my answer to Eric, yes, it better to use the same key(s) for LDP hello authentication as the ones used for TCP session. If the WG agrees on this, we will explicitly describe it in next version.

BR,
Vero

From: Mallette, Edwin 
Sent: Tuesday, October 26, 2010 4:35 AM
To: Vero Zheng ; mpls 
Subject: RE: [mpls] [MPLS] HELP: Need your opinion on LDP security

Vero,

Ed

Hi Folks,

BR,

Mach and Vero

--------------------------------------------------------------------------------
CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

---

From: Vishwas Manral <[email-masked]>
Date: Mon, 25 Oct 2010 21:21:07 -0700

Hi Vero/ Mach,

I had thought of this in some detail earlier.

My reasoning is the follows. Thinking of what we loose if we do not
authentication in LDP Hellos. We will go ahead and try to establish
TCP sessions (which will anyway fail as TCP authentication is there).

If we think of what we loose when adding the Authentication in Hellos,
it is using additional CPU capacity and an additional mechanism which
is an overhead. There is nothing to loose in case of replays as the
TCP messages are authenticated and session will be dropped even if
Hellos are retransmitted.

That said I had added a section for support of IPsec for LDP in the
IPv6 draft (which we dropped as it was slightly out of context in the
draft). You may want to consider that.

Thanks,
Vishwas

2010/10/24 Vero Zheng <[email-masked]>:
> [RFC5036] does not provide any security mechanisms for use with Hello
> messages except to note that some configuration may help protect against
> bogus discovery events.
>
> We have submitted a new "LDP Hello Cryptographic Authentication" draft. In
> this draft, we introduce a new Cryptographic Authentication TLV which is
> used in LDP Hello message as an optional parameter.
> The URL for it is:
> http://tools.ietf.org/id/draft-zheng-mpls-ldp-hello-crypto-auth-00.txt
> _______________________________________________
> mpls mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mpls
>
>

---

From: Vero Zheng <[email-masked]>
Date: Tue, 26 Oct 2010 15:20:56 +0800

Thanks Vishwas,
Please see my answers in-line.

BR,
Vero

--------------------------------------------------
From: "Vishwas Manral" <[email-masked]>
Sent: Tuesday, October 26, 2010 12:21 PM
To: "Vero Zheng" <[email-masked]>
Cc: "mpls" <[email-masked]>
Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security

> TCP sessions (which will anyway fail as TCP authentication is there).

When there is no authentication in Hello, the established LDP session could be possibly tore town by spoofing attack. One malicious node can do this by specifing a smaller Hold Time than previous agreed one, or by changing the Transport Address. This is the problem which TCP austhentication can not help.  In order to combat , it is RECOMMENDED that all deployments use the Cryptographic Authentication TLV to secure the Hello message
> Hellos are retransmitted.

IMHO, this is a common tradeoff. Whether to utilize the authentication is totally the choice of the operator,thats why its Optional. Our mechanism also provide several cryptographic algorithms which varies in the security strength and the resources needed. .

---

From: Mach Chen <[email-masked]>
Date: Tue, 26 Oct 2010 15:31:45 +0800

Hi Vishwas,

Thanks for your comments.

As you said, TCP authentication can prevent a LDP node establishing LDP 
session with a unauthorized node. But it could NOT prevent a malicious node 
tearing down the existing LDP session by spoofing attack, this is issue that 
our draft tries to solve.

Best regards,
Mach

>> This means that they cannot benefit from the security mechanisms 
>> available
>> with TCP.
>> Do we need to allow the use of different keys from the ones used on the 
>> TCP
>> session?
>>
>> An LSR can be configured to only accept Hello messages from specific 
>> peers
>> when authentication is in use.
>> The URL for it is: