Subject: [OSPF] [Technical Errata Reported] RFC6506 (3567)

From: RFC Errata System <[email-masked]>
Date: Wed, 27 Mar 2013 05:37:52 -0700 (PDT)

The following errata report has been submitted for RFC6506,
"Supporting Authentication Trailer for OSPFv3".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6506&eid=3567

--------------------------------------
Type: Technical
Reported by: Marek Karasek <[email-masked]>

Section: 2.2

Original Text
-------------
   Consistent with OSPFv2 Cryptographic Authentication [RFC2328], both
   OSPFv3 header checksum calculation and verification are omitted when
   the OSPFv3 authentication mechanism described in this specification
   is used.

Corrected Text
--------------
OSPFv3 authentication mechanism provides capability to detect corruption of
OSPFv3 packet, which is under non authenticated operation achieved using OSPFv3
header checksum [RFC 5340] and LLS data block checksum [RFC 5613]. In spirit of
OSPFv2 Cryptographic Authentication [RFC2328], OSPFv3 header checksum and LLS 
Data Block Checksum calculation and verification are omitted when the OSPFv3
authentication mechanism described in this specification is used.

Notes
-----
RFC does not specify how to work with LLS Data Block Checksum. Errata suggests omit checksum calculation/verification in the same way like for OSPFv3 header checksum.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6506 (draft-ietf-ospf-auth-trailer-ospfv3-11)
--------------------------------------
Title               : Supporting Authentication Trailer for OSPFv3
Publication Date    : February 2012
Author(s)           : M. Bhatia, V. Manral, A. Lindem
Category            : PROPOSED STANDARD
Source              : Open Shortest Path First IGP
Area                : Routing
Stream              : IETF
Verifying Party     : IESG

---

From: t.petch <[email-masked]>
Date: Fri, 29 Mar 2013 21:10:28 +0000

Looks like a functional change to me.

Tom Petch

----- Original Message -----
From: "RFC Errata System" <[email-masked]>
To: <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Wednesday, March 27, 2013 12:37 PM

> RFC does not specify how to work with LLS Data Block Checksum. Errata
suggests omit checksum calculation/verification in the same way like for
OSPFv3 header checksum.

---

From: "Marek Karasek (mkarasek)" <[email-masked]>
Date: Fri, 29 Mar 2013 22:10:21 +0000

Hi Tom,

RFC 6506 specifies how to work with OSPFv3 header checksum, but does not specify how to work with LLS data block checksum. For interoperability reasons it would be very useful if it's documented.

There are basically only two options:
a) compute LLS checksum as usual
b) omit, like for OSPFv3 Header checksum

Errata suggests b) because I do not see why to authenticate portion of packet 2x.

It may be seen as operational change if there's some implementation doing a). Are you aware of any?

Thanks marek

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of t.petch
Sent: Friday, March 29, 2013 10:10 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [OSPF] [Technical Errata Reported] RFC6506 (3567)

Tom Petch

----- Original Message -----
From: "RFC Errata System" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>; <[email-masked]>; <[email-masked]>; <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Wednesday, March 27, 2013 12:37 PM

> use "Reply All" to discuss whether it should be verified or rejected. 
> When a decision is reached, the verifying party (IESG) can log in to 
> change the status and edit the report, if necessary.
>

_______________________________________________
OSPF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ospf

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Sun, 31 Mar 2013 10:55:21 +0530

Hi Marek,

When constructing the LLS data block it may not always be possible for an implementation to know whether there is authentication being used on a link or not. Sure there are ways for us to figure this out but it may not be a very modular approach (really an implementation specific issue).

If you follow rfc 6506 and do as it says then you can always choose NOT to verify the LLS checksum upon reciept and still be compliant to 6506.

This way nothing changes - Your original code for LLS still computes the checksum regardless of whether OSPFv3 AT is configured or not. The AT code computes the digest of the packet including the LLS data block.

The reciever verifies the AT data block and accepts the packet if it matches with whats carried in the packet. Its now an implementation specific issue whether it wants to verify the LLS checksum or not.

Given this I don't think the errata raised is correct - more so, because this isnt really an error in the RFC. 

Even if we'd discussed this issue when we were writing this RFC we would have left it as an implementation specific behavior at the RX side based on the modularity argument.

Based on this argument I would also reject the errata 3568 that has been raised. 

Cheers, Manav

> From: RFC Errata System [mailto:[email-masked]] 
> Sent: Wednesday, March 27, 2013 6:08 PM
> To: Bhatia, Manav (Manav); [email-masked]; 
> [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: [Technical Errata Reported] RFC6506 (3567)
> 
>    Consistent with OSPFv2 Cryptographic Authentication 
> [RFC2328], both    OSPFv3 header checksum calculation and 
> verification are omitted when    the OSPFv3 authentication 
> mechanism described in this specification    is used. 
> 
> Corrected Text
> --------------
> OSPFv3 authentication mechanism provides capability to detect 
> corruption of OSPFv3 packet, which is under non authenticated 
> operation achieved using OSPFv3 header checksum [RFC 5340] 
> and LLS data block checksum [RFC 5613]. In spirit of OSPFv2 
> Cryptographic Authentication [RFC2328], OSPFv3 header 
> checksum and LLS  Data Block Checksum calculation and 
> verification are omitted when the OSPFv3 authentication 
> mechanism described in this specification is used.
> 
> Notes
> -----
> RFC does not specify how to work with LLS Data Block 
> Checksum. Errata suggests omit checksum 
> calculation/verification in the same way like for OSPFv3 
> header checksum.
> 
> Instructions:
> -------------
> This errata is currently posted as "Reported". If necessary, 
> please use "Reply All" to discuss whether it should be 
> verified or rejected. When a decision is reached, the 
> verifying party (IESG) can log in to change the status and 
> edit the report, if necessary. 
>