RFC 6094
Summary of Cryptographic Authentication Algorithm Implementation Requirements for Routing Protocols
RFC 6094: Summary of Cryptographic Authentication Algorithm Implementation Requirements for Routing Protocols 🎀
okay bestie, this is RFC 6094 💖 It's from the IETF (Internet Engineering Task Force), and it's an Informational doc, so it's published for info and isn't a Standards Track spec 🌸 The authors are M. Bhatia from Alcatel-Lucent and V. Manral from IP Infusion. It came out in February 2011 and has ISSN 2070-1721 ✨ The title block doesn't list anything it obsoletes or updates, so it's a standalone main character 👑
Abstract ✨
okay so the routing protocols OSPFv2, IS-IS, and RIP currently have cleartext and MD5 (Message Digest 5) ways to authenticate their packets 🙈 Lately people have been pushing to add the SHA (Secure Hash Algorithm) family of hash functions for authenticating RIP, IS-IS, and OSPF packets 🔥
It's imperative that we agree on a minimal set of algorithms that every implementation has to support, so there's at least one algorithm everyone shares 🫶 That's how implementations from different vendors can actually talk to each other 💅
RIPng (RIP for IPv6) and OSPFv3 use IPsec algorithms to authenticate their packets, which is giving secure vibes 🦋
This doc looks at the algorithms that are available right now, focusing on interoperability and how well they actually protect authentication 💜 Cryptographic authentication for these protocols only works when the same algorithms exist across different implementations. It's desirable that newly specified algorithms get implemented and made available in routing protocol implementations, since they might get promoted to requirements later on ✨
Status of This Memo ✨
This doc is not an Internet Standards Track specification. It's published for informational purposes 🌈
It's a product of the IETF, and it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). Not every doc the IESG approves is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 for the details 💀
You can find info about the current status of this doc, any errata, and how to send feedback at http://www.rfc-editor.org/info/rfc6094 🍓
Copyright Notice 🌸
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully, because they spell out your rights and restrictions for this doc 🧚 Any Code Components pulled out of this doc must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 💜
Table of Contents 🦋
1. Introduction ....................................................3
2. Intermediate System to Intermediate System (IS-IS) ..............4
2.1. Authentication Scheme Selection ............................4
2.2. Authentication Algorithm Selection .........................5
3. Open Shortest Path First Version 2 (OSPFv2) .....................5
3.1. Authentication Scheme Selection ............................6
3.2. Authentication Algorithm Selection .........................6
4. Open Shortest Path First Version 3 (OSPFv3) .....................7
5. Routing Information Protocol Version 2 (RIPv2) ..................7
5.1. Authentication Scheme Selection ............................7
5.2. Authentication Algorithm Selection .........................8
6. Routing Information Protocol for IPv6 (RIPng) ...................8
7. Security Considerations .........................................9
8. Acknowledgements ................................................9
9. References .....................................................10
9.1. Normative References ......................................10
9.2. Informative References ....................................101. Introduction 🎀
okay so most routing protocols have three kinds of authentication: Null authentication, cleartext password, and cryptographic authentication 💅 Null authentication is basically the same as having no authentication at all 🙈
With a cleartext scheme (also called a "simple password" scheme), the password goes over the wire totally unprotected 😭 Anyone with physical access to the network can read it and mess with the integrity of the routing domain 💀 The simple password scheme only guards against accidentally forming routing sessions in a domain. Beyond that, it doesn't give you any extra protection 🥲
In a cryptographic authentication scheme, routers share a secret key that's used to make a message authentication code for each protocol packet 🔐 Right now, routing protocols that do message authentication codes usually use a Keyed-MD5 [RFC1321] digest. The recent wave of attacks on MD5 has people worried about how much useful life it has left ⏳
These attacks might not directly break Keyed-MD5 digests as message authentication codes, since the colliding message may not be a syntactically correct protocol packet 🤔 The known collision, pre-image, and second pre-image attacks [RFC4270] on MD5 may not make key recovery attacks on HMAC-MD5 any stronger. Even so, there's a real need to deprecate MD5 [RFC1321] as the basis for the Hashed Message Authentication Code (HMAC) algorithm and move to stronger digest algorithms 🔥
So there are proposals to swap HMAC-MD5 for keyed HMAC-SHA [SHS] digests. Right now HMAC-MD5 is the mandated option in RIPv2 [RFC2453], IS-IS [ISO] [RFC1195], and Keyed-MD5 in OSPFv2 [RFC2328] 🌈
OSPFv3 [RFC5340] and RIPng [RFC2080] rely on the IPv6 Authentication Header (AH) [RFC4302] and IPv6 Encapsulating Security Payload (ESP) [RFC4303] to provide integrity, authentication, and/or confidentiality ✨
But here's the thing: crypto keeps getting better, and attack techniques keep getting refined too 🧠 An algorithm that's strong today could be shown to be weak tomorrow 😬 So the choice of preferred algorithm should favor minimizing the chance that it gets compromised quickly 🛡️
Preferred algorithms will change over time as threats evolve 🦋 At any given moment, the mandatory-to-implement algorithm(s) might not be in the base protocol spec. As protocols get extended, wanting stronger algorithms creates a problem for interoperability between existing and future implementations, both in terms of standards and in terms of what operators prefer to deploy 💭
An implementation should support changing its security (authentication) keys. Swapping the symmetric key used in any HMAC algorithm on a regular schedule is good security practice 💖 Operators need to plan for it 📅
Implementations can support in-service key change so no control packets get lost 🫶 During an in-service/in-band key change, more than one key can be active for receiving packets in a session. Some protocols support a key identifier, which lets the two peers of a session have multiple keys at the same time 🔑
Right now, though, these protocols manage keys manually (that is, via operator intervention) or dynamically, based on some timer or security protocol ⏰
2. Intermediate System to Intermediate System (IS-IS) 💜
The IS-IS spec lets you authenticate its Protocol Data Units (PDUs) using the authentication TLV (TLV 10) in the PDU 🧚 The base spec [ISO] only had provisions for cleartext passwords. [RFC5304] upgrades that with cryptographic authentication for IS-IS PDUs, and it mandates support for HMAC-MD5 🔐
[RFC5310] adds support for using any cryptographic hash function to authenticate IS-IS PDUs. On top of that, [RFC5310] also details how IS-IS can use the HMAC construct together with the SHA family of cryptographic hash functions to secure IS-IS PDUs 🌸
2.1. Authentication Scheme Selection 🎀
For IS-IS implementations to securely interoperate, they must support one or more authentication schemes in common. This section sets out the preference for standards-conformant IS-IS implementations that use accepted authentication schemes 💅
The earliest interoperability requirement for authentication, as stated by [ISO] [RFC1195], required all implementations to support a cleartext password. That scheme is only useful for stopping someone from accidentally adding a new IS to a broadcast domain 🙈 Operators should not use it, because it gives zero protection against an attacker with access to the broadcast domain. Anyone can read the secret password just by inspecting the PDU 💀 It doesn't provide any meaningful level of security, so avoid it 🚫
[RFC5304] defined the cryptographic authentication scheme for IS-IS. HMAC-MD5 was the only algorithm it specified, so that one is mandated 🔒 [RFC5310] defined a generic cryptographic scheme and added support for more algorithms. Implementations should support [RFC5310], since it defines the generic cryptographic authentication scheme ✨
2.2. Authentication Algorithm Selection 🦋
For IS-IS implementations to securely interoperate, they must have support for one or more authentication algorithms in common 💖
This section details the authentication algorithm requirements for standards-conformant IS-IS implementations 📋
These are the available options for authentication algorithms:
- [RFC5304] mandates the use of HMAC-MD5.
- [RFC5310] doesn't require a particular algorithm. Instead, it supports any digest algorithm (that is, any cryptographic hash function) 🌈
As we said earlier, there's a desire to deprecate MD5 😤 IS-IS implementations will probably migrate to an authentication scheme supported by [RFC5310], because it's algorithm agnostic 🧠 Possible digest algorithms include SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 🔥 Picking at least one mandatory-to-implement algorithm is imperative for making sure interoperability works 🫶
3. Open Shortest Path First Version 2 (OSPFv2) 🌸
[RFC2328] includes three kinds of authentication: Null authentication, cleartext password (defined as "simple password" in [RFC2328]), and cryptographic authentication. Null authentication is semantically equivalent to no authentication 🙈
In the cryptographic authentication scheme, OSPFv2 routers on a common network/subnet are configured with a shared secret, which is used to generate a Keyed-MD5 digest for each packet 🔐 A monotonically increasing sequence number scheme protects against replay attacks ⏭️
[RFC5709] adds support for using the SHA family of hash algorithms to authenticate OSPFv2 packets 💜✨
3.1. Authentication Scheme Selection ✨
okay bestie, so for OSPF routers to securely interoperate, they have to have one or more authentication schemes in common 🫶
Null authentication is on the list for every implementation because [RFC2328] mandates it 💅, but it's not appropriate anywhere the operator wants to authenticate OSPFv2 packets in their network 🙈
Cleartext passwords are also mandated by [RFC2328], so every implementation supports them too 🔑. The catch is that they're only appropriate when the operator wants to stop a router from getting into the domain by accident. For authenticating OSPFv2 packets they are patently not useful 💀
Cryptographic authentication is a mandatory scheme defined in [RFC2328], and all conformant implementations must support it 🔐✨
3.2. Authentication Algorithm Selection 🦋
okay so for OSPFv2 implementations to securely interoperate, they must support one or more cryptographic authentication algorithms in common 💖
Here are the available options for authentication algorithms:
- [RFC2328] specifies the use of Keyed-MD5.
- [RFC5709] specifies the use of HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512, and also mandates support for HMAC-SHA-256 (HMAC-SHA-1 is optional).
As I mentioned earlier, there's a desire to deprecate MD5 😭. Some alternatives for MD5 are listed in [RFC5709].
Possible digest algorithms include SHA-1, SHA-256, SHA-384, and SHA-512. Picking one mandatory-to-implement algorithm is imperative to making sure everyone can interoperate 👑
4. Open Shortest Path First Version 3 (OSPFv3) 🧚
OSPFv3 [RFC5340] leans on the IPv6 Authentication Header (AH) [RFC4302] and the IPv6 Encapsulating Security Payload (ESP) [RFC4303] to provide integrity, authentication, and/or confidentiality 🌈
[RFC4552] mandates the use of ESP for authenticating OSPFv3 packets. Implementations could also choose to support using AH to protect these packets 🍓
The algorithm requirements for AH and ESP are described in [RFC4835], as follows:
- [RFC2404] mandates HMAC-SHA-1-96.
- [RFC3566] indicates AES-XCBC-MAC-96 as a "should", but it's likely that this will be mandated at some future time 👀
5. Routing Information Protocol Version 2 (RIPv2) 🌸
RIPv2 was originally specified in [RFC1388] and then in [RFC1723], and it has been updated and published as STD 56, [RFC2453] 💅. If the Address Family Identifier of the first (and only the first) entry in the RIPv2 message is 0xFFFF, then the rest of that entry contains the authentication information. The [RFC2453] version of the protocol provides for authenticating packets using a cleartext password (defined as "simple password" in [RFC2453]) that is not more than 16 octets in length 🔑
[RFC2082] added support for Keyed-MD5 authentication, where a digest is appended to the end of the RIP packet ✨. [RFC4822] obsoleted [RFC2082] and added the SHA family of hash algorithms to the list of cryptographic authentications that can protect RIPv2. Before that, [RFC2082] only specified the use of Keyed-MD5 🙈
5.1. Authentication Scheme Selection 🎀
For RIPv2 implementations to securely interoperate, they must support one or more authentication schemes in common 🫶
While all implementations will support a cleartext password since it's mandated by [RFC2453], its use is only appropriate when the operator wants to stop a router from getting into the domain by accident. It's patently not useful when an operator wants to authenticate RIPv2 packets 💀
[RFC2082] mandates the use of an authentication scheme that uses Keyed-MD5. However, [RFC2082] has been obsoleted by [RFC4822]. Compliant implementations must provide support for an authentication scheme that uses Keyed-MD5, but they should recognize that this is superseded by cryptographic authentication as defined in [RFC4822] 🦋
Implementations should provide support for [RFC4822], since it specifies the RIPv2 cryptographic authentication schemes 💖
5.2. Authentication Algorithm Selection 🌈
For RIPv2 implementations to securely interoperate, they must support one or more authentication algorithms in common 💅
Here are the available options for authentication algorithms:
- [RFC2082] specifies the use of Keyed-MD5.
- [RFC4822] specifies the use of Keyed-MD5, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512.
As I mentioned earlier, there's a desire to deprecate MD5 😭. Some alternatives for MD5 are listed in [RFC4822]. Possible digest algorithms include SHA-1, SHA-256, SHA-384, and SHA-512. Picking one mandatory-to-implement algorithm is imperative to making sure everyone can interoperate 👑
6. Routing Information Protocol for IPv6 (RIPng) 🧚♀️
RIPng [RFC2080] leans on the IPv6 Authentication Header (AH) [RFC4302] and the IPv6 Encapsulating Security Payload (ESP) [RFC4303] to provide integrity, authentication, and/or confidentiality ✨
The algorithm requirements for AH and ESP are described in [RFC4835], as follows:
- [RFC2404] mandates HMAC-SHA-1-96.
- [RFC3566] indicates AES-XCBC-MAC-96 as a "should", but it's likely that this will be mandated at some future time 👀
7. Security Considerations 🔐
okay bestie, this section is SERIOUS 😭 read every word, no skipping!!
The cryptographic mechanisms referenced in this document provide only authentication algorithms. These algorithms do not provide confidentiality. Encrypting the content of the packet, and thereby providing confidentiality, is not considered in the definition of the routing protocols 🙈
The cryptographic strength of the HMAC depends on the cryptographic strength of the underlying hash function and on the size and quality of the key. The feasibility of attacking the integrity of routing protocol messages protected by keyed digests may be significantly more limited than that of other data. However, preference for one family of algorithms over another may also change independently of the perceived risk to a particular protocol 🧐
To ensure greater security, the keys used should be changed periodically, and implementations must be able to store and use more than one key at the same time. Operational experience suggests that the lack of periodic rekeying is a source of significant exposure, and that the lifespan of shared keys in the network is frequently measured in years 💀
While simple password schemes are well represented in the document series and in conformant implementations of the protocols, the inability to offer either integrity or identity protection is sufficient reason to strongly discourage their use 🚫
This document concerns itself with the selection of cryptographic algorithms for use in authenticating routing protocol packets exchanged between adjacent routing processes. The cryptographic algorithms identified in this document are not known to be broken at the current time, and ongoing cryptographic research so far leads us to believe that they will likely remain secure in the foreseeable future. We expect that new revisions of this document will be issued in the future to reflect current thinking on the algorithms that various routing protocols should employ, so that disparate implementations can keep interoperating 🌸
8. Acknowledgements 🫶
We would like to thank Joel Jaeggli, Sean Turner, and Adrian Farrel for their comments and feedback on this document, which resulted in significant improvement of the same 💖
9. References 📚
9.1. Normative References
[ISO] "Intermediate system to Intermediate system routing
information exchange protocol for use in conjunction with
the protocol for providing the connectionless-mode
network service", ISO/IEC 10589:1992 (ISO 8473).
[RFC1195] Callon, R., "Use of OSI IS-IS for routing in TCP/IP and
dual environments", RFC 1195, December 1990.
[RFC2080] Malkin, G. and R. Minnear, "RIPng for IPv6", RFC 2080,
January 1997.
[RFC2328] Moy, J., "OSPF Version 2", STD 54, RFC 2328, April 1998.
[RFC2453] Malkin, G., "RIP Version 2", STD 56, RFC 2453,
November 1998.
[RFC4822] Atkinson, R. and M. Fanto, "RIPv2 Cryptographic
Authentication", RFC 4822, February 2007.
[RFC4835] Manral, V., "Cryptographic Algorithm Implementation
Requirements for Encapsulating Security Payload (ESP) and
Authentication Header (AH)", RFC 4835, April 2007.
[RFC5304] Li, T. and R. Atkinson, "IS-IS Cryptographic
Authentication", RFC 5304, October 2008.
[RFC5310] Bhatia, M., Manral, V., Li, T., Atkinson, R., White, R.,
and M. Fanto, "IS-IS Generic Cryptographic
Authentication", RFC 5310, February 2009.
[RFC5340] Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
for IPv6", RFC 5340, July 2008.
[RFC5709] Bhatia, M., Manral, V., Fanto, M., White, R., Barnes, M.,
Li, T., and R. Atkinson, "OSPFv2 HMAC-SHA Cryptographic
Authentication", RFC 5709, October 2009.9.2. Informative References
[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
April 1992.
[RFC1388] Malkin, G., "RIP Version 2 Carrying Additional
Information", RFC 1388, January 1993.
[RFC1723] Malkin, G., "RIP Version 2 - Carrying Additional
Information", RFC 1723, November 1994.
[RFC2082] Baker, F. and R. Atkinson, "RIP-2 MD5 Authentication",
RFC 2082, January 1997.
[RFC2404] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96 within
ESP and AH", RFC 2404, November 1998.
[RFC3566] Frankel, S. and H. Herbert, "The AES-XCBC-MAC-96
Algorithm and Its Use With IPsec", RFC 3566,
September 2003.
[RFC4270] Hoffman, P. and B. Schneier, "Attacks on Cryptographic
Hashes in Internet Protocols", RFC 4270, November 2005.
[RFC4302] Kent, S., "IP Authentication Header", RFC 4302,
December 2005.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)",
RFC 4303, December 2005.
[RFC4552] Gupta, M. and N. Melam, "Authentication/Confidentiality
for OSPFv3", RFC 4552, June 2006.
[SHS] "Secure Hash Standard (SHS)", National Institute of
Standards and Technology (NIST) FIPS Publication 180-3,
October 2008.Authors' Addresses 💌
Manav Bhatia
Alcatel-Lucent
Bangalore
India
EMail: manav.bhatia@alcatel-lucent.com
Vishwas Manral
IP Infusion
1188 E. Arques Ave.
Sunnyvale, CA 94089
USA
Phone: 408-400-1900
EMail: vishwas@ipinfusion.com📦 where this page comes from
- ietf: rfc6094 2011-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms