Subject: bfd.AuthType

From: "Shahram Davari" <[email-masked]>
Date: Thu, 20 Aug 2009 11:22:50 -0700

Hi,

I have a question regarding Authentication. The BFD reception rules say:

"If the A bit is set and no authentication is in use (bfd.AuthType is zero), the packet MUST be discarded."

"If the A bit is clear and authentication is in use (bfd.AuthType is nonzero), the packet MUST be discarded."

How do we know the value of bfd.AuthType? Is it a configured value or is it derived from the "Auth Type" field of the received BFD packets? if it is derived from received BFD packets the value zero is reserved for "Auth Type" and is not defined.

Any explanations?

Also I noticed that the text says SHA1 is mandatory and others are optional. Which SHA1 does it mean? the Keyed or Meticulous Keyed SHA1? Can we change then Mandatory to Simple Password?

Thanks,

Shahram

---

From: Vishwas Manral <[email-masked]>
Date: Thu, 20 Aug 2009 11:35:50 -0700

Hi Shahram,

Its an interesting way you have put the question.

The way I see it is, if Authentication is enabled on an interface we
expect the packet to have the A-bit set, however if we do not get a
packet with the A bit clear we discard the packet.

There have been issues raised regarding the security in BFD, because
of which we have written another draft. We intend to make meticulously
keyed HMAC-SHA-1 to be a MUST in the future.

Thanks,
Vishwas

On Thu, Aug 20, 2009 at 11:22 AM, Shahram Davari<[email-masked]> wrote:
> How do we know the value of bfd.AuthType? Is it a configured value or is it
> derived from the "Auth Type" field of the received BFD packets? if it is
> derived from received BFD packets the value zero is reserved for "Auth Type"
> and is not defined.
>
> Any explanations?
>
> Also I noticed that the text says SHA1 is mandatory and others are optional.
> Which SHA1 does it mean? the Keyed or Meticulous Keyed SHA1? Can we change
> then Mandatory to Simple Password?
>
> Thanks,
>
> Shahram

---

From: Dave Katz <[email-masked]>
Date: Thu, 20 Aug 2009 14:10:22 -0600

On Aug 20, 2009, at 12:22 PM, Shahram Davari wrote:

> How do we know the value of bfd.AuthType? Is it a configured value  
> or is it derived from the "Auth Type" field of the received BFD  
> packets? if it is derived from received BFD packets the value zero  
> is reserved for "Auth Type" and is not defined.
>
It's a known value outside of the spec;  configuration is one way to  
do it.

> Any explanations?
>
> Also I noticed that the text says SHA1 is mandatory and others are  
> optional. Which SHA1 does it mean? the Keyed or Meticulous Keyed  
> SHA1? Can we change then Mandatory to Simple Password?
>
SHA1 is mandatory to implement (for interoperability) but not to  
deploy.  The spec is ambiguous as to regular vs. meticulous;  I'll fix  
it to say that both must be supported (99.9% of the work is in the  
hash algorithm itself;  the difference between regular and meticulous  
is a few lines of code.)

--Dave