RE: key change for TCP-MD5

Mailman List Mirror (Read Only)
1

The draft allows you to have a set of keys in your keychain and
the implementation tries all of them before declaring the segment
as invalid.

No time synchronization required. No BGP message required.

The added cost for CPU-bound systems is that they have to try
(potentially) multiple keys before getting the **right** key
but in real life this can be easily mitigated by having a rating
system on the key based on the frequency of success.

Regards

Bora

2

What if we agree to change the key on our BGP session, I add the new key on my side and start sending packets using the new key, while you don't have the new key in your configuration yet?

3

The added cost for CPU-bound systems is that they have to try
(potentially) multiple keys before getting the **right** key

once

4

What if we agree to change the key on our BGP session, I add the new
key on my side and start sending packets using the new key, while you
don't have the new key in your configuration yet?

again: try reading the draft

5

I've read the draft and it "solves" this problem with timing. That's insufficient because it requires that both sides do the right thing at the right time without any way to verify whether the other side is ready. What if one side didn't make the change, or entered the wrong key?

I think I've sufficiently explained myself now, I'm not going to do it again.

6

How is that *any* different than you sending an e-mail saying "Here's the new
key we'll put into production at 3:17:04.97 GMT, hope you're NTP-synced" and
not waiting for an ACK from the other end before proceeding?

I'd encourage my competitors to design their procedures that way, but it only
works for competitors that you aren't either peering or directly transiting
with. Otherwise, you're merely handing them a loaded gun to point at your
feet...

7

Uh, isn't what this,

   "In particular, if a key change has just been
   attempted but such segments are not acknowledged, it is reasonable to
   fall back to the previous key and issue an alert of some sort."

Is for? Automated fallback if a new key doesn't work?