RFC 5304
IS-IS Cryptographic Authentication
RFC 5304: IS-IS Cryptographic Authentication 🎀
Okay bestie, this one is from October 2008 and it's a Standards Track doc from the Network Working Group 💅. T. Li (Redback Networks, Inc.) and R. Atkinson (Extreme Networks, Inc.) wrote it. It obsoletes RFC 3567 and updates RFC 1195. The whole thing is about giving IS-IS authentication a glow-up ✨
Status of This Memo
Real talk: this is an Internet standards track protocol for the whole Internet community, and it's literally asking for discussion and suggestions for improvements 🫶. For the official standardization state and status, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Abstract
So this doc describes how to authenticate Intermediate System to Intermediate System (IS-IS) Protocol Data Units (PDUs) using HMAC-MD5 (Hashed Message Authentication Codes - Message Digest 5), the algorithm from RFC 2104 🔐. IS-IS is specified in International Standards Organization (ISO) 10589, and its IPv4 extensions are described in RFC 1195 🦋. The base spec already has an authentication mechanism that can handle multiple authentication algorithms, but it only defines the algorithm for cleartext passwords 🙈. This document replaces RFC 3567.
This doc proposes an extension that lets HMAC-MD5 be used alongside the existing authentication mechanisms 💜
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Authentication Procedures . . . . . . . . . . . . . . . . . . . 3
2.1. Implementation Considerations . . . . . . . . . . . . . . . 5
3. Security Considerations . . . . . . . . . . . . . . . . . . . . 5
3.1. Security Limitations . . . . . . . . . . . . . . . . . . . 5
3.2. Assurance . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.3. Key Configuration . . . . . . . . . . . . . . . . . . . . . 6
3.4. Other Considerations . . . . . . . . . . . . . . . . . . . 7
3.5. Future Directions . . . . . . . . . . . . . . . . . . . . . 7
4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 7
5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 8
6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 8
6.1. Normative References . . . . . . . . . . . . . . . . . . . 8
6.2. Informative References . . . . . . . . . . . . . . . . . . 91. Introduction ✨
Okay so IS-IS, as specified in [ISO-10589], can authenticate Link State Protocol Data Units (LSPs) by putting authentication info inside the LSP itself 🔐. That info is encoded as a Type-Length-Value (TLV) tuple. IS-IS for IPv4 networks is covered in [RFC1195] 🌸
The TLV type is 10, and its length is variable. The value depends on the authentication algorithm and the related secrets being used. The first octet of the value gives the authentication type: type 0 is reserved, type 1 means a cleartext password, and type 255 is for routing domain private authentication methods 👑. Whatever is left over in the TLV value is called the Authentication Value 💅
This doc levels things up by allocating a new authentication type for HMAC-MD5 and specifying how to compute the Authentication Value. It also describes changes to the base protocol so that the authentication mechanisms in this document actually work 🦋
This document is a publication of the IS-IS Working Group within the IETF. It replaces [RFC3567], which is an Informational RFC, and it's on the Standards Track 🎀. It also revised Section 3, with the big new addition of a discussion of recent attacks on MD5 in Section 3.2. Plus, it added a real "IANA Considerations" section to create a codepoint registry that was missing before 📋
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💜
2. Authentication Procedures 🔐
The authentication type for HMAC-MD5 is 54 (0x36) 🍓. The Authentication Value for HMAC-MD5 is 16 octets long, and the length field in the TLV is 17.
HMAC-MD5 takes a key K and text T as input [RFC2104]. The key K is the password for the PDU type, as specified in ISO 10589 🗝️. The text T is the IS-IS PDU being authenticated, with the Authentication Value field (inside the Authentication Information TLV) set to zero. Heads up: the Authentication Type is set to 54 and the length of the TLV is set to 17 before authentication is computed ⭐. When LSPs are authenticated, the Checksum and Remaining Lifetime fields are set to zero (0) before authentication is computed. The result of the algorithm goes into the Authentication Value field ✨
When calculating the HMAC-MD5 result for Sequence Number PDUs, Level 1 Sequence Number PDUs SHALL use the Area Authentication string, the same as Level 1 Link State PDUs do. Level 2 Sequence Number PDUs SHALL use the domain authentication string, the same as Level 2 Link State PDUs do. IS-IS Hello PDUs SHALL use the Link Level Authentication String, which MAY be different from the one used for Link State PDUs 🫶. The HMAC-MD5 result for IS-IS Hello PDUs SHALL be calculated after the packet is padded to the MTU size, if padding is not disabled. Implementations that support the optional checksum for Sequence Number PDUs and IS-IS Hello PDUs MUST NOT include the Checksum TLV 🙅♀️
To authenticate an incoming PDU, a system should save the values of the Authentication Value field, the Checksum field, and the Remaining Lifetime field, set those fields to zero, compute authentication, and then restore the saved values 🧚
An implementation that implements HMAC-MD5 authentication and receives HMAC-MD5 Authentication Information MUST discard the PDU if the Authentication Value is incorrect. No exceptions, bestie 💀
An implementation MAY have a transition mode where it includes HMAC-MD5 Authentication Information in PDUs but does not verify it. This is a transition aid for networks that are in the middle of deploying authentication 🌈
An implementation MAY check a set of passwords when verifying the Authentication Value. This gives you a way to change passwords across a network little by little ✨
An implementation that does not implement HMAC-MD5 authentication MAY accept a PDU that contains the HMAC-MD5 Authentication Type 🦋. ISes (routers) that implement HMAC-MD5 authentication and initiate LSP purges MUST remove the body of the LSP and add the authentication TLV. ISes implementing HMAC-MD5 authentication MUST NOT accept unauthenticated purges. ISes MUST NOT accept purges that contain TLVs other than the authentication TLV. These restrictions exist to stop a hostile system from grabbing an LSP, setting the Remaining Lifetime field to zero, and flooding it, which would start a purge without knowing the authentication password. Not on my watch 😤
2.1. Implementation Considerations 🛠️
There's an implementation issue that happens just after password rollover on an IS-IS router, and it might be worth some extra commentary 🙈. Right after the rollover, the router or IS-IS process may restart. If that happens, the LSP Sequence Number restarts from the value 1 using the new password. But neighbors will reject those new LSPs because the Sequence Number is smaller 😭. The router can't increase its own LSP Sequence Number because it fails to authenticate its own old LSP, which the neighbors keep sending back to it. So the router can't update its LSP Sequence Number with its neighbors until they all time out the original LSPs 💀
One possible fix is for the IS-IS process to check whether any inbound LSP with an authentication failure has the local System ID and a higher Sequence Number than the IS-IS process currently has. If so, the IS-IS process SHOULD increase its own LSP Sequence Number to match and re-flood the LSPs 🔥. However, this scenario could also be triggered by an active attack from an adversary, so it is recommended that a counter be kept for this case to mitigate the risk from such an attack 🧐
3. Security Considerations 🔒
This document enhances the security of the IS-IS routing protocol. A routing protocol carries information that doesn't need to be kept secret, so privacy is not a requirement. Authentication of the messages within the protocol is the real priority, though, because it cuts the risk of an adversary messing with the routing system by deliberately injecting false information into it 🚨
3.1. Security Limitations 🙅♀️
The technology here gives IS-IS an authentication mechanism. It is not perfect, and it does not need to be perfect 💅. What it does do is seriously raise the work function for an adversary attacking IS-IS, without causing undue implementation, deployment, or operational complexity. Compared to cleartext password authentication, it gives improved security against passive attacks as defined in [RFC1704] ✨
This mechanism does not prevent replay attacks. However, in most cases, replays would trigger existing mechanisms in IS-IS that effectively reject old information 🌸. Denial-of-service attacks generally can't be prevented in a useful networking protocol [DoS] 😔
The mechanisms in this document don't protect against compromised, malfunctioning, or misconfigured routers. Those routers can, accidentally or on purpose, cause malfunctions that affect the whole routing domain 💀. Go read [RFC4593] for a more comprehensive description of threats to routing protocols 📚
3.2. Assurance 🔐
Okay bestie, real talk: how secure this mechanism is depends completely on three things. The strength of the authentication algorithms, the strength of the key, and whether every IS-IS implementation gets the security part right. It also only works if everyone keeps the IS-IS Authentication Key confidential 🤫. If any one of those is off or not strong enough, then no real security is happening for anyone using this mechanism. Not it 💀
Dobbertin's attacks on MD5 [Dobb96a] [Dobb96b] [Dobb98] came out a dozen years ago, and people have been side-eyeing the compression function inside MD5 ever since. Then Wang and Yu [WY05] made those concerns even louder 📉. BUT (and this is the plot twist) nobody has published an attack on Keyed-MD5 or HMAC-MD5 so far 🙌. Bellare [Bell06a] [Bell06b] also dropped new proofs for HMAC's security that need fewer assumptions than the older HMAC proofs did ✨. Those proofs say the known MD5 problems (and the separate SHA-1 ones) don't turn into an attack on HMAC-MD5 or HMAC SHA-1 💖. Then Fouque and others [FLN07] published new attacks on NMAC-MD4, HMAC-MD4, and NMAC-MD5. Still, those attacks are computationally non-trivial, and they haven't found an equivalent one for HMAC-MD5 🫠. So even with all the MD5 drama, there's no published attack that hits HMAC-MD5 as used in this IS-IS spec. As with any crypto, though, future attacks against this mechanism could still show up 👀 so stay alert, babe 🦋
3.3. Key Configuration 🗝️
Quick heads up: the key configuration mechanism on your routers might limit which keys you can use between peers 🙈. It is strongly recommended that an implementation be able to support, at minimum, a key made of printable ASCII that's 80 bytes or less, because that's what's current practice 💅
3.4. Other Considerations 🧩
Changing the authentication mechanism described here was discussed for ages. The main idea was adding a Key-ID field like the one in OSPFv2 and RIPv2. In the end, though, it got rejected 😭. This mechanism was already widely implemented in 1999, and as of writing it's still pretty widely deployed among the folks who care about cryptographic authentication of IS-IS 🌸. The upgrade wasn't big enough to justify the change, especially with the installed base and the fact that operators weren't interested in deploying a revised mechanism 🙃
If and when a key management protocol shows up that's both widely implemented and easy to deploy for securing routing protocols like IS-IS, a different authentication mechanism designed to work with that key management scheme could be added if people want it 🔑✨
3.5. Future Directions 🔭
If someone decided they needed stronger authentication, using a full digital signature [RFC2154] would be an approach that should be seriously considered 🖋️. It got rejected for this purpose for now because full digital signatures are believed to be way more computationally expensive than is reasonable, given the current threat environment in operational commercial networks 💸
If and when additional authentication mechanisms get defined (for example, to provide a cryptographically stronger hash function), it will also be necessary to define mechanisms that allow a graceful transition from the existing mechanisms (as defined in this document) to whatever comes next 🦋🌈
4. IANA Considerations 📚
IANA has created a new codepoint registry to manage the Authentication Type codepoints for TLV 10 💖. This registry is part of the existing IS-IS codepoints registry, which was set up by [RFC3563] and [RFC3359]. It's managed using the Designated Expert policy described in [RFC5226], and it's called "IS-IS Authentication Type Codes for TLV 10" 📋
The values in the "IS-IS Authentication Type Codes for TLV 10" registry should be recorded in decimal, and they should only get approved after a designated expert, appointed by the IESG area director, has been consulted 🧐. The goal is that any allocation comes with a published RFC. However, the designated expert can approve allocations once it's clear an RFC will be published, so values can be allocated before the document is approved for publication as an RFC ⏩. New items should be documented in a publicly and freely available specification. We should also allow external specifications to allocate and use the IS-IS Authentication Type Codes maintained by this registry 🌍
The initial values for the "IS-IS Authentication Type Codes for TLV 10" registry are below. Future assignments will be made through Expert Review. Each assignment consists of an authentication type name and its associated value 🎀
+---------------------------------------------+-------+-------------+
| Authentication Type Code | Value | Reference |
+---------------------------------------------+-------+-------------+
| Reserved | 0 | [ISO-10589] |
| Cleartext Password | 1 | [ISO-10589] |
| ISO 10589 Reserved | 2 | [ISO-10589] |
| HMAC-MD5 Authentication | 54 | RFC 5304 |
| Routeing Domain private authentication | 255 | [ISO-10589] |
| method | | |
+---------------------------------------------+-------+-------------+5. Acknowledgements 🫶
The authors want to thank (in alphabetical order) Stephen Farrell, Dave Katz, Steven Luong, Tony Przygienda, Nai-Ming Shen, and Henk Smit for their comments and suggestions on this document 💜
6. References 📖
6.1. Normative References 🔒
[ISO-10589]ISO, "Intermediate System to Intermediate System intra-domain routeing information exchange protocol for use in conjunction with the protocol for providing the connectionless-mode network service (ISO 8473)", International Standard 10589:2002, Second Edition, 2002.[RFC2104]Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
6.2. Informative References 📝
[Bell06a]Bellare, M., "New Proofs for NMAC and HMAC: Security without Collision-Resistance", Preliminary Version, in Proceedings of Crypto 2006, Lecture Notes in Computer Science, Vol. 4117, August 2006.[Bell06b]Bellare, M., "New Proofs for NMAC and HMAC: Security without Collision-Resistance", August 2006,<http://www-cse.ucsd.edu/users/mihir/papers/hmac-new.html>.[DoS]Voydock, V. and S. Kent, "Security Mechanisms in High-level Networks", ACM Computing Surveys Vol. 15, No. 2, June 1983.[Dobb96a]Dobbertin, H., "Cryptanalysis of MD5 Compress", EuroCrypt Rump Session 1996, May 1996.[Dobb96b]Dobbertin, H., "The Status of MD5 After a Recent Attack", CryptoBytes, Vol. 2, No. 2, 1996.[Dobb98]Dobbertin, H., "Cryptanalysis of MD4", Journal of Cryptology, Vol. 11, No. 4, 1998.[FLN07]Fouque, P., Leurent, G., and P. Nguyen, "Full Key-Recovery Attacks on HMAC/NMAC-MD5 and NMAC-MD5", Proceedings of Crypto 2007, August 2007.[RFC1195]Callon, R., "Use of OSI IS-IS for routing in TCP/IP and dual environments", RFC 1195, December 1990.[RFC1704]Haller, N. and R. Atkinson, "On Internet Authentication", RFC 1704, October 1994.[RFC2154]Murphy, S., Badger, M., and B. Wellington, "OSPF with Digital Signatures", RFC 2154, June 1997.[RFC3359]Przygienda, T., "Reserved Type, Length and Value (TLV) Codepoints in Intermediate System to Intermediate System", RFC 3359, August 2002.[RFC3563]Zinin, A., "Cooperative Agreement Between the ISOC/IETF and ISO/IEC Joint Technical Committee 1/Sub Committee 6 (JTC1/SC6) on IS-IS Routing Protocol Development", RFC 3563, July 2003.[RFC3567]Li, T. and R. Atkinson, "Intermediate System to Intermediate System (IS-IS) Cryptographic Authentication", RFC 3567, July 2003.[RFC4593]Barbir, A., Murphy, S., and Y. Yang, "Generic Threats to Routing Protocols", RFC 4593, October 2006.[RFC5226]Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.[WY05]Wang, X. and H. Yu, "How to Break MD5 and Other Hash Functions", Proceedings of EuroCrypt 2005, Lecture Notes in Computer Science, Vol. 3494, 2005.
Authors' Addresses 📮
Tony Li
Redback Networks, Inc.
300 Holger Way
San Jose, CA 95134
USA
Phone: +1 408 750 5160
EMail: tony.li@tony.li
R. Atkinson
Extreme Networks, Inc.
3585 Monroe St.
Santa Clara, CA 95051
USA
Phone: +1 408 579 2800
EMail: rja@extremenetworks.comFull Copyright Statement ©️
Copyright (C) The IETF Trust (2008) 🌷
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth there, the authors keep all their rights 📜
This document and the info in it are provided "AS IS". THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT USING THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS, OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🙏
Intellectual Property 🪪
The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described here, or on whether any license under those rights might or might not be available. It also doesn't claim to have made any independent effort to identify such rights 🤷♀️ Info on the procedures for rights in RFC documents can be found in BCP 78 and BCP 79 💅
Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to get a general license or permission to use such proprietary rights by implementers or users of this spec can be found in the IETF online IPR repository at http://www.ietf.org/ipr 🔗
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology needed to implement this standard. Please send that info to the IETF at ietf-ipr@ietf.org 💌
📦 where this page comes from
- ietf: rfc5304 2008-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms