KARP W. Atwood
Internet-Draft R. Bangalore Somanatha
Intended status: Standards Track Concordia University/CSE
Expires: August 29, 2013 February 25, 2013
Automatic Key and Adjacency Management for Routing Protocols
draft-atwood-karp-akam-rp-03
Abstract
When tightening the security of the core routing infrastructure, two
steps are necessary. The first is to secure the routing protocols'
packets on the wire. The second is to ensure that the keying
material for the routing protocol exchanges is distributed only to
the appropriate routers. This document specifies requirements on
that distribution and proposes the use of a set of protocols to
achieve those requirements.
Status of this Memo
This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 29, 2013.
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
Atwood & Bangalore Somanatha Expires August 29, 2013 [Page 1]
Internet-Draft KARP AKAM-RP February 2013
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
2. Keying Groups (Key Scopes) . . . . . . . . . . . . . . . . . . 4
2.1. Keying Groups . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Key Scopes . . . . . . . . . . . . . . . . . . . . . . . . 5
3. Problem Statement . . . . . . . . . . . . . . . . . . . . . . 6
3.1. Security Goals . . . . . . . . . . . . . . . . . . . . . . 6
3.2. Non-security Goals . . . . . . . . . . . . . . . . . . . . 6
4. High Level Design . . . . . . . . . . . . . . . . . . . . . . 7
4.1. Global View . . . . . . . . . . . . . . . . . . . . . . . 7
4.2. Entities in the system . . . . . . . . . . . . . . . . . . 7
4.3. Protocol Operations . . . . . . . . . . . . . . . . . . . 9
5. Detailed Design . . . . . . . . . . . . . . . . . . . . . . . 10
5.1. System Design . . . . . . . . . . . . . . . . . . . . . . 11
5.1.1. Communication among the Entities . . . . . . . . . . . 11
5.1.2. Inner View of a GM . . . . . . . . . . . . . . . . . . 13
5.1.3. Hierarchical Design . . . . . . . . . . . . . . . . . 14
5.2. Protocol Design . . . . . . . . . . . . . . . . . . . . . 14
5.2.1. Step 1 - Initial Exchanges: GCKS, GM mutual
authentication . . . . . . . . . . . . . . . . . . . . 15
5.2.2. Step 2 - Key Management Message Exchanges between
GCKS, GM . . . . . . . . . . . . . . . . . . . . . . . 16
5.2.3. Step 3 - GM-GM mutual authentication . . . . . . . . . 19
5.2.4. Step 4 - Key Management Message Exchanges between
GMs . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.2.5. Variations for handling other Keying Groups . . . . . 22
6. Other Aspects of the Key Management Problem . . . . . . . . . 24
6.1. Key Updates . . . . . . . . . . . . . . . . . . . . . . . 24
6.2. Regular Key Updates . . . . . . . . . . . . . . . . . . . 26
6.2.1. Same key for the entire AD . . . . . . . . . . . . . . 26
6.2.2. Key per link . . . . . . . . . . . . . . . . . . . . . 26
6.2.3. Key per sending router . . . . . . . . . . . . . . . . 27
6.2.4. Key per sending router per interface . . . . . . . . . 27
datatracker.ietf.org