Subject: [secdir] [karp] FW: Non IPSec Authentication mechanism for OSPFv3 (fwd)

From: Sandra Murphy <[email-masked]>
Date: Sun, 26 Sep 2010 16:24:59 -0400 (Eastern Daylight Time)

Authentication in OSPFv3 (for IPv6) differs from OSPFv2.  OSPFv2 has 
an authentication mechanism in-band in the mechanism (recently updated in 
5709).  OSPFv3 relies on IPSec, but with manual keying so it has no replay 
protection.  That's been an issue.

The draft below suggests a new authentication mechanism for ospfv3 other 
than ipsec.

I note that the abstact says:

       Currently OSPFv3 uses IPSec for authenticating the protocol
       packets. This draft proposes an alternative ? Generic
       Authentication that can be used so that OSPFv3 does not depend
       upon IPSec for security. The mechanism introduced in this draft
       is generic and can be used by any protocol that currently uses
       IPSec for authentication.

The proposed use of this mechanism for uses beyond ospfv3 seems like it 
might be interesting to this group.

I note also that the name given the proposed extension header is "Generic 
Authentication".

The draft is

http://tools.ietf.org/html/draft-bhatia-karp-non-ipsec-ospfv3-auth-00

--Sandy

---------- Forwarded message ----------
Date: Sat, 25 Sep 2010 06:05:11 +0530
From: "Bhatia, Manav (Manav)" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: [karp] FW: Non IPSec Authentication mechanism for OSPFv3

Hi,

Currently OSPFv3 uses only IPSec for authentication. I have written a small draft that uses provides a different authentication mechanism - non IPSec based, for OSPFv3 as IPSec is generally considered inadequate for routing protocols. Would be great if folks can review and provide some feedback on this.

http://tools.ietf.org/html/draft-bhatia-karp-non-ipsec-ospfv3-auth-00

Cheers, Manav
_______________________________________________
karp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/karp