Subject: RE: Authentication

From: "Gray, Eric" <[email-masked]>
Date: Thu, 17 Mar 2005 13:40:15 -0500

Dave,

	Is it actually the case that the IESG will not allow
the document to advance without requiring SHA-1, or is it
the case that we either mandate it or we define the security
and/or trust environment in which it is, or is not, required?

	One could make the case that authentication is not 
required for devices that are not directly exposed to the
big I.  In such devices, it could also be the case that
realistic authentication is unlikely to be feasible. In
that case, and assuming that making an attempt to provide
authentication that is even approximately realistic has a
non-zero cost - even if it is never turned on - why would
we want to mandate authentication for such devices?

--
Eric

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Dave Katz
Sent: Thursday, March 17, 2005 1:29 PM
To: Chris Nogradi
Cc: [email-masked]
Subject: Re: Authentication

On Mar 17, 2005, at 7:08 AM, Chris Nogradi wrote:

> Dave,
>
> I just noticed that you have added the following sentence to the base 
> draft in
> section 6.6:
>
> "Implementations MUST support SHA1 authentication.  Other froms of
> authentication are optional."
>
> Since you did not make mention of this in the document changes 
> sections, I
> assume that this does not mean that all implementations must support 
> at least
> this form of authentication.  Is the purpose of this sentence to say 
> that if
> an implementation uses authentication, it must support SHA1?

Sorry, I forgot to list that in the changes.

This is in there because the IESG will not allow the document to 
advance without it.  It's an interesting question as to whether they 
would allow the spec to say that an implementation could have no 
authentication at all;  my guess is that their stand is that the spec 
must require that all implementations support SHA1 authentication.

I also expect that vendors will make their own choices, as there is no 
significant difference between an implementation in which nobody turns 
on authentication and an implementation that does not even include it.

But that's the word from on high.

>
> BTW, there is a typo in this sentence as it should say "forms" instead 
> of
> "froms".

Thanks...

--Dave

---

From: Dave Katz <[email-masked]>
Date: Thu, 17 Mar 2005 12:00:21 -0700

> and/or trust environment in which it is, or is not, required?

I'm not sure, Dave2 or Jeff could comment.  My impression was that they 
would not let the document advance without it being fully mandatory.

> we want to mandate authentication for such devices?\

I fully agree.

I suspect that the reality is that most vendors who are only interested 
in single hop BFD will throw a CPU-based authentication implementation 
in and continue to use the TTL hack and nobody will use it.  Or else 
they will just leave it out (but then some customer will demand it 
because the spec says it has to be there, and they'll be forced to do 
the above.)

--Dave

---

From: David Ward <[email-masked]>
Date: Sun, 20 Mar 2005 11:53:10 -0600

We have been told that the document will not proceed w/o SHA-1 being
mandatory. MD5 is also strongly suggested. An implementation can choose to
also offer no authentication. The protocol can easily support all three
options for deployment. 

-DWard