IS-IS Cryptographic Authentication
RFC 5304

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 03

Network Working Group                                              T. Li
Request for Comments: 5304                        Redback Networks, Inc.
Obsoletes: 3567                                              R. Atkinson
Updates: 1195                                     Extreme Networks, Inc.
Category: Standards Track                                   October 2008

                   IS-IS Cryptographic Authentication

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This document describes the authentication of Intermediate System to
   Intermediate System (IS-IS) Protocol Data Units (PDUs) using the
   Hashed Message Authentication Codes - Message Digest 5 (HMAC-MD5)
   algorithm as found in RFC 2104.  IS-IS is specified in International
   Standards Organization (ISO) 10589, with extensions to support
   Internet Protocol version 4 (IPv4) described in RFC 1195.  The base
   specification includes an authentication mechanism that allows for
   multiple authentication algorithms.  The base specification only
   specifies the algorithm for cleartext passwords.  This document
   replaces RFC 3567.

   This document proposes an extension to that specification that allows
   the use of the HMAC-MD5 authentication algorithm to be used in
   conjunction with the existing authentication mechanisms.

Li & Atkinson               Standards Track                     [Page 1]
RFC 5304           IS-IS Cryptographic Authentication       October 2008

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 3
   2.  Authentication Procedures . . . . . . . . . . . . . . . . . . . 3
     2.1.  Implementation Considerations . . . . . . . . . . . . . . . 5
   3.  Security Considerations . . . . . . . . . . . . . . . . . . . . 5
     3.1.  Security Limitations  . . . . . . . . . . . . . . . . . . . 5
     3.2.  Assurance . . . . . . . . . . . . . . . . . . . . . . . . . 6
     3.3.  Key Configuration . . . . . . . . . . . . . . . . . . . . . 6
     3.4.  Other Considerations  . . . . . . . . . . . . . . . . . . . 7
     3.5.  Future Directions . . . . . . . . . . . . . . . . . . . . . 7
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 7
   5.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . 8
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 8
     6.1.  Normative References  . . . . . . . . . . . . . . . . . . . 8
     6.2.  Informative References  . . . . . . . . . . . . . . . . . . 9

Li & Atkinson               Standards Track                     [Page 2]
RFC 5304           IS-IS Cryptographic Authentication       October 2008

1.  Introduction

   The IS-IS protocol, as specified in [ISO-10589], provides for the
   authentication of Link State Protocol Data Units (LSPs) through the
   inclusion of authentication information as part of the LSP.  This
   authentication information is encoded as a Type-Length-Value (TLV)
   tuple.  The use of IS-IS for IPv4 networks is described in [RFC1195].

   The type of the TLV is specified as 10.  The length of the TLV is
   variable.  The value of the TLV depends on the authentication
   algorithm and related secrets being used.  The first octet of the
   value is used to specify the authentication type.  Type 0 is
   reserved, type 1 indicates a cleartext password, and type 255 is used
   for routing domain private authentication methods.  The remainder of
   the TLV value is known as the Authentication Value.

   This document extends the above situation by allocating a new
   authentication type for HMAC-MD5 and specifying the algorithms for
   the computation of the Authentication Value.  This document also
   describes modifications to the base protocol to ensure that the
   authentication mechanisms described in this document are effective.

   This document is a publication of the IS-IS Working Group within the
   IETF.  This document replaces [RFC3567], which is an Informational
   RFC.  This document is on the Standards Track.  This document has
   revised Section 3, with the significant addition of a discussion of
   recent attacks on MD5 in Section 3.2.  This document has also added a
   substantive "IANA Considerations" section to create a missing
   codepoint registry.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

2.  Authentication Procedures

   The authentication type used for HMAC-MD5 is 54 (0x36).  The length
   of the Authentication Value for HMAC-MD5 is 16, and the length field