Subject: Re: Reg: DDOS prevention in OSPF

From: "Nanda Kishore S." <[email-masked]>
Date: Thu, 23 Feb 2006 09:58:02 +0530

Ofcourse IPSec does the same, but how many are deploying it that way ??

And certainly when we are writing MD5 authentication why not improve
it and have it in place for ease of configuration and administration 
with some improvement for DDOS.  

-Nanda

-----Original Message-----
From: Mailing List [mailto:[email-masked]] On Behalf Of Fred
Baker
Sent: Wednesday, February 22, 2006 6:45 PM
To: [email-masked]
Subject: Re: Reg: DDOS prevention in OSPF

Dumb question: why no use IPsec, which (unless I am mistaken)  
accomplishes the same thing?

Historically, the reason we built MD5 authentication into OSPF was  
because IPsec couldn't produce a result to save its soul. This  
authentication mechanism is basically borrowed more or less directly  
from the IPsec AH drafts of the time. IPsec produced a result...

On Feb 22, 2006, at 1:40 AM, Nanda Kishore S. wrote:
> My idea is implementing MD5 authentication at socket level at  
> greater speeds (DDOS attack's speed) is not feasible or won't give  
> such performance so, why not have a cascaded authentication  
> mechanism like (Simple password + MD5) so, that before queuing of  
> packets we can do simple password at greater efficiency and MD5 for  
> better security later.