Re: BFD Authentication

[Vishwas Manral <vishwas.ietf at gmail.com>]

Hi Shahram,

I raised issues on the security of BFD a lot of them got resolved in
the base draft itself.
www.ietf.org/mail-archive/web/rtg-bfd/current/msg00480.html
www.ietf.org/mail-archive/web/rtg-bfd/current/msg00488.html

Here is the document we wrote to address the other concern. It also
talks about a way of doing Key Rollovers like you mentioned.

http://tools.ietf.org/html/draft-bhatia-bfd-crypto-auth-00

Thanks,
Vishwas

On Tue, Aug 18, 2009 at 2:48 PM, Shahram Davari<davari at broadcom.com> wrote:
> Hi,
>
> Reading through base draft, it seems that the suggested Authentication
> methods (password, MD5 and SHA1) are all very weak authentications and not
> really used any more. Is it too late to propose another simple but yet
> powerful Authentication such as GMAC?
>
> Also since the Authentication Type is communicated in each packet does it
> mean that it is allowed to change Authentication type in the middle of a BFD
> session?
>
> Thanks,
> Shahram