Optimizing BFD Authentication
draft-ietf-bfd-optimizing-authentication-07
Network Working Group M. Jethanandani
Internet-Draft VMware
Intended status: Standards Track A. Mishra
Expires: May 15, 2019 SES Networks
A. Saxena
Ciena Corporation
M. Bhatia
Nokia
November 11, 2018
Optimizing BFD Authentication
draft-ietf-bfd-optimizing-authentication-07
Abstract
This document describes an optimization to BFD Authentication as
described in Section 6.7 of BFD RFC5880.
Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14 [RFC2119]
[RFC8174] when, and only when, they appear in all capitals, as shown
here.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on May 15, 2019.
Jethanandani, et al. Expires May 15, 2019 [Page 1]
Internet-Draft BFD Authentication Optimization November 2018
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Authentication Mode . . . . . . . . . . . . . . . . . . . . . 3
3. NULL Auth TLV . . . . . . . . . . . . . . . . . . . . . . . . 4
4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5
5. Security Considerations . . . . . . . . . . . . . . . . . . . 6
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
6.1. Normative References . . . . . . . . . . . . . . . . . . 6
6.2. Informative References . . . . . . . . . . . . . . . . . 6
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7
1. Introduction
Authenticating every BFD [RFC5880] packet with a Simple Password, or
with a MD5 Message-Digest Algorithm [RFC1321] , or Secure Hash
Algorithm (SHA-1) algorithms is computationally intensive process,
making it difficult if not impossible to authenticate every packet -
particularly at faster rates. Also, the recent escalating series of
attacks on MD5 and SHA-1 [SHA-1-attack1] [SHA-1-attack2] raise
concerns about their remaining useful lifetime as outlined in Updated
Security Considerations for the MD5 Message-Digest and the HMAC-MD5
Algorithm [RFC6151] and Security Considerations for the SHA-0 and
SHA-1 Message-Digest Algorithm [RFC6194]. If replaced by stronger
algorithms, the computational overhead, will make the task of
authenticating every packet even more difficult to achieve.
This document proposes that only BFD frames that signal a state
change in BFD be authenticated. Rest of the frames can be
transmitted and received without authentication enabled. Most frames
that are transmitted and received have no state change associated
with them. Limiting authentication to frames that affect a BFD
session state allows more sessions to be supported for
Jethanandani, et al. Expires May 15, 2019 [Page 2]
Internet-Draft BFD Authentication Optimization November 2018
authentication. Moreover, most BFD frames that signal a state change
are generally transmitted at a slower interval of 1s leaving enough
time to compute the hash. To detect a Man In the Middle (MITM)
Show full document text