Re: bfd.AuthType

[Vishwas Manral <vishwas.ietf at gmail.com>]

Hi Shahram,

Its an interesting way you have put the question.

The way I see it is, if Authentication is enabled on an interface we
expect the packet to have the A-bit set, however if we do not get a
packet with the A bit clear we discard the packet.

There have been issues raised regarding the security in BFD, because
of which we have written another draft. We intend to make meticulously
keyed HMAC-SHA-1 to be a MUST in the future.

Thanks,
Vishwas

On Thu, Aug 20, 2009 at 11:22 AM, Shahram Davari<davari at broadcom.com> wrote:
> Hi,
>
> I have a question regarding Authentication. The BFD reception rules say:
>
>
> "If the A bit is set and no authentication is in use (bfd.AuthType is zero),
> the packet MUST be discarded."
>
> "If the A bit is clear and authentication is in use (bfd.AuthType is
> nonzero), the packet MUST be discarded."
>
> How do we know the value of bfd.AuthType? Is it a configured value or is it
> derived from the "Auth Type" field of the received BFD packets? if it is
> derived from received BFD packets the value zero is reserved for "Auth Type"
> and is not defined.
>
> Any explanations?
>
> Also I noticed that the text says SHA1 is mandatory and others are optional.
> Which SHA1 does it mean? the Keyed or Meticulous Keyed SHA1? Can we change
> then Mandatory to Simple Password?
>
> Thanks,
>
> Shahram