Subject: Mail regarding draft-ietf-bfd-optimizing-authentication

From: Gregory Mirsky <[email-masked]>
Date: Thu, 30 Jun 2016 18:26:02 +0000

Dear Authors,
I've got a question on how the proposed mechanism to use Authentication only for the state transition signaling affects the state machine. Consider BFD implementation that uses HW-assistance. BFD control packets with NUL Auth TLV can easily be validated in the HW but those that have real Authentication may require a punt and processing out of the fast path. Authenticated packet to be validated must pass authentication verification and that may happen much later. If we imagine, though it is a stretch, that the next two packets get lost or corrupted, then we may have false negative because validation of the authenticated packet is outside of the normal validation path.
Or consider another scenario when validation fails because of the Authentication. Should this have immediate impact on the state machine? If not, the new state will be learnt from the very next BFD control packet, which is not authenticated as I understand the proposal. Then what is the benefit of sending state change with Authentication?

                Regards,
                                Greg