Network Working Group Y. Wei, Ed. Internet-Draft H. Wang Expires: January 6, 2011 X. Liang ZTE Corporation July 5, 2010 Analysis of Security Association for Current Routing Protocol draft-wei-karp-analysis-rp-sa-00 Abstract This document analyzes the security associations used by current routing protocols, including RIPv2, OSPFv2, ISIS, BFD, and BGP. It also discusses the possible methods for the diversity issue of routing protocol security association (SA). Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on January 6, 2011. Copyright Notice Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Wei, et al. Expires January 6, 2011 [Page 1] Internet-Draft analysis-rp-sa July 2010 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Analysis of security associations for current routing protocols . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Summary for security associations of current routing protocol . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.2. Analysis of security associations of current routing protocol . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.3. Discussion of generic security association . . . . . . . . 8 3. security considerations . . . . . . . . . . . . . . . . . . . 9 4. IANA considerations . . . . . . . . . . . . . . . . . . . . . 10 5. appendix: Existing SA definition . . . . . . . . . . . . . . . 11 5.1. RIPv2 SA . . . . . . . . . . . . . . . . . . . . . . . . . 11 5.2. OSPFv2 SA . . . . . . . . . . . . . . . . . . . . . . . . 11 5.3. ISIS SA . . . . . . . . . . . . . . . . . . . . . . . . . 12 5.4. BFD SA . . . . . . . . . . . . . . . . . . . . . . . . . . 12 5.5. TCP-AO . . . . . . . . . . . . . . . . . . . . . . . . . . 13 6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 15 Wei, et al. Expires January 6, 2011 [Page 2] Internet-Draft analysis-rp-sa July 2010 1. Introduction The karp (Keying and Authentication for Routing Protocols) working group aims to secure the packets on the wire of the routing protocol exchanges. This work has been divided into two phases, (1) Enhance the routing protocol's current authentication mechanism; (2) Develop an automated keying framework [ietf-karp-design-guide]. Currently, there are a variety of routing protocols. Many routing protocols (or groups of protocols) have already defined security association (SA) for cryptographic message authentication and integrity protection, which are listed in the appendix. SA is the basis for protecting the packet of routing protocol; it may also affect the design of key management protocol (KMP) and framework of the karp. As a start, it is desirable to analyze existing security associations of routing protocols. The main idea of this document is as follows: (1) Briefly overview of existing SA of routing protocols. (2) Compare those typical fields in routing protocol SA one by one, and identify potential issues. (3) Discuss the possible methods for that problem. Wei, et al. Expires January 6, 2011 [Page 3] Internet-Draft analysis-rp-sa July 2010 2. Analysis of security associations for current routing protocols This section considers the security associations of the following routing protocols: RIPv2, OSPFv2, ISIS, BFD, and BGP. Note: Maybe there are lacks of commonly accepted term - BGP SA. This document regards Master Key Tuple (MKT) in TCP-AO [ietf-tcpm-tcp-auth-opt] as BGP SA. 2.1. Summary for security associations of current routing protocol The security associations of current routing protocol are summarized as follows: -The RIPv2 SA [RFC4822] includes the following information: key identifier, cryptographic algorithms, key length, sequence number, and life time of SA. -The OSPFv2 SA [RFC5709] includes the following information: key identifier, cryptographic algorithms, key length, and life time of SA. -The ISIS SA [RFC5310] includes the following information: key identifier, cryptographic algorithms, key length. -The BFD SA [draft-bhatia-bfd-crypto-auth] includes the following information: key identifier, cryptographic algorithms, key identifier. -The BGP SA [ietf-tcpm-tcp-auth-opt] includes the following information: key identifier, cryptographic algorithms, master key, key derivation function (KDF), sequence number, etc. The details of these SAs are listed in the appendix. 2.2. Analysis of security associations of current routing protocol The fields in the above security associations are analyzed as follows: - Key identifier: Key identifier (Key ID) is used to uniquely identify a SA. All SAs used in routing protocols specify this field. For example, OSPFv2 SA defines Key Identifier field to identify an OSPF SA. Wei, et al. Expires January 6, 2011 [Page 4] Internet-Draft analysis-rp-sa July 2010 +--------------/-----------------/------------------+ | SA of Routing| Name of Key ID | Length of Key ID | | Protocol | | | ---------------|-----------------|------------------- | RIPv2 | Key Identifier | 8 bits | ---------------|-----------------|------------------- | OSPFv2 | Key Identifier | 8 bits | ---------------|-----------------|------------------- | ISIS | Key Identifier | 2 octets | ---------------|-----------------|------------------- | BFD | Authentication | 2 octets | | | Key Identifier | | ---------------|-----------------|------------------- | BGP | KeyID | 8 bits | +--------------\-----------------\------------------+ The key identifier maybe manually be configured or generated by automated key management protocol (KMP) which is one ongoing work in karp. One obvious distinction among these routing protocols' SA is that the length of key ID is different. If KMP generates key ID according to specific routing protocol, the design of KMP will be complex and bound to underlying routing protocol. - Cryptographic algorithms and key: For the purpose of authentication and integrity protection, the algorithm and key are used to produce message authentication code (MAC), which is used to protect the packet on the wire. Typically, key length is related to a specific algorithm. Wei, et al. Expires January 6, 2011 [Page 5] Internet-Draft analysis-rp-sa July 2010 +----------------/-------------------/-----------------------------+ | SA of Routing | Algorithms | Key Length | | Protocol | | | -----------------|-------------------|------------------------------ | RIPv2 | KEYED-MD5, | The length is variable | | | HMAC-SHA-1, | and dependent on algorithm | | | HMAC-SHA-256, | | | | HMAC-SHA-384, | | | | HMAC-SHA-512. | | -----------------|-------------------|------------------------------ | OSPFv2 | Keyed-MD5, | Same as above | | | HMAC-SHA-1, | | | | HMAC-SHA-256, | | | | HMAC-SHA-384, | | | | HMAC-SHA-512 | | -----------------|-------------------|------------------------------ | ISIS | HMAC-SHA-1, | Same as above | | | HMAC-SHA-224, | | | | HMAC-SHA-256, | | | | HMAC-SHA-384, | | | | HMAC-SHA-512 | | -----------------|-------------------|------------------------------ | BFD | Keyed MD5, | Same as above | | | Keyed SHA-1, | | | | HMAC-SHA-1, | | | | HMAC-SHA-256, | | | | HMAC-SHA-384 | | | | HMAC-SHA-512 | | -----------------|-------------------|------------------------------ | BGP | Keyed MD5 | Same as above | | | HMAC-SHA-1-96 | | | | AES-128-CMAC-96 | | +----------------\-------------------\-----------------------------+ The cryptographic algorithms used in routing protocol are almost the same except for the protection of BGP, which is based on TCP-AO. This case also shows that manual configuration or KMP are also required to differentiate underlying routing protocol, which makes them complex. - Lifetime: It specifies whether the SA is valid or not. For example, OSPFv2 SA [RFC5709] uses four fields (Key Start Accept, Key Start Generate, Key Stop Generate, Key Stop Accept) to control the lifetime of the SA. Wei, et al. Expires January 6, 2011 [Page 6] Internet-Draft analysis-rp-sa July 2010 +---------------/--------------------+ | SA of Routing | Fields | | Protocol | | ----------------|--------------------- | RIPv2 | Start Time | | | Stop Time | ----------------|--------------------- | OSPFv2 | Key Start Accept | | | Key Start Generate | | | Key Stop Generate | | | Key Stop Accept | ----------------|--------------------- | ISIS | None | ----------------|--------------------- | BFD | None | +---------------\--------------------+ It can be seen that some routing protocols' SA define lifetime, others do not. This implies that underlying routing protocol does not exhibit unified interface to upper layer. In some cases, a rekeying mechanism is used to trigger the lifetime of SA. However, current routing protocol SA does not specify what to do when the key expires. -Sequence number: Sequence number is typically defined to avoid replay attacks. +---------------/---------------------+ | SA of Routing | Length of Sequence | | Protocol | number | --------------------------------------- | RIPv2 | 32bits | --------------------------------------- | OSPFv2 | 32bits | --------------------------------------- | ISIS | 32bits | --------------------------------------- | BFD | 32bits | --------------------------------------- | BGP | 32bits | +---------------\---------------------+ The length of sequence number above is 32 bits, which is convenient to the manual configuration or KMP because it is unrelated to underlying routing protocol. Wei, et al. Expires January 6, 2011 [Page 7] Internet-Draft analysis-rp-sa July 2010 2.3. Discussion of generic security association As shown in section 2.2, the definition and its value of SA is different for each routing protocol. This document just covers part of routing protocol. Some other routing protocols such as OSPFv3, RIPng depends on the protection of IPsec SA [RFC4301]. If this case is taken into consideration, the differences among these SAs are more bigger. It is required to consider the diversity of routing protocol SA when starting the karp's work. Here are two possible ways to deal with this issue. (1) Each routing protocol (or category) has its own specific manual configuration or KMP. The advantage is that it can be implemented easily and straightforwardly. The disadvantage is obvious: The system is complex and cumbersome because there exist a dozen of routing protocols. In this case, the karp's work seems complicated. (2)A generic SA (gSA) is introduced to hide the diversity of underlying routing protocol SA. It can be regarded as abstract layer; it is a bridge between manual configuration or KMP protocol and routing protocol. The advantages are as follows: (1)It provides a unified interface to manual configuration or KMP protocol. (2)It decouples KMP with underlying routing protocol, which addresses the requirement identified in [I-D.ietf-karp-threats-req]. (3)KMP and routing protocol can be evolved independently. (4)The complexity of the design of KMP is greatly reduced. The disadvantage of this method may be that a new layer is added, which produces extra cost. Wei, et al. Expires January 6, 2011 [Page 8] Internet-Draft analysis-rp-sa July 2010 3. security considerations To be completed. Wei, et al. Expires January 6, 2011 [Page 9] Internet-Draft analysis-rp-sa July 2010 4. IANA considerations To be completed. Wei, et al. Expires January 6, 2011 [Page 10] Internet-Draft analysis-rp-sa July 2010 5. appendix: Existing SA definition This section is for information. It can be safely removed in the future. 5.1. RIPv2 SA RIPv2 Security Association:[RFC4822] KEY-IDENTIFIER (KEY-ID) - The unsigned 8-bit KEY-ID value is used to identify the RIPv2 Security Association in use for this packet. AUTHENTICATION ALGORITHM - This specifies the cryptographic algorithm and algorithm mode used with the RIPv2 Security Association. AUTHENTICATION KEY - This is the value of the cryptographic authentication key used with the associated Authentication Algorithm. SEQUENCE NUMBER - This is an unsigned 32-bit number. START TIME - This is a local representation of the day and time that this Security Association first becomes valid. STOP TIME - This is a local representation of the day and time that this Security Association becomes invalid 5.2. OSPFv2 SA OSPFv2 Security Association: [RFC5709] Key Identifier (KeyID) - This is an 8-bit unsigned value used to uniquely identify an OSPFv2 SA and is configured either by the router administrator (or, in the future, possibly by some key management protocol specified by the IETF). The receiver uses this to locate the appropriate OSPFv2 SA to use. The sender puts this KeyID value in the OSPF packet based on the active OSPF configuration. Authentication Algorithm - This indicates the authentication algorithm (and also the cryptographic mode, such as HMAC) to be used. This information SHOULD never be sent over the wire in cleartext form. At present, valid values are Keyed-MD5, HMAC-SHA-1, HMAC-SHA- 256, HMAC-SHA-384, and HMAC-SHA-512. Authentication Key - This is the cryptographic key used for cryptographic authentication with this OSPFv2 SA. Key Start Accept - The time that this OSPF router will accept packets that have been created with this OSPF Security Association. Wei, et al. Expires January 6, 2011 [Page 11] Internet-Draft analysis-rp-sa July 2010 Key Start Generate - The time that this OSPF router will begin using this OSPF Security Association for OSPF packet generation. Key Stop Generate - The time that this OSPF router will stop using this OSPF Security Association for OSPF packet generation. Key Stop Accept - The time that this OSPF router will stop accepting packets generated with this OSPF Security Association. 5.3. ISIS SA An IS-IS Security Association contains a set of parameters shared between any two legitimate IS-IS speakers. Parameters associated with an IS-IS SA: [RFC5310] Key Identifier (Key ID) - This is a two-octet unsigned integer used to uniquely identify an IS-IS SA, as manually configured by the network operator. The receiver determines the active SA by looking at the Key ID field in the incoming PDU. The sender, based on the active configuration, selects the Security Association to use and puts the correct Key ID value associated with the Security Association in the IS-IS PDU. If multiple valid and active IS-IS Security Associations exist for a given outbound interface at the time an IS-IS PDU is sent, the sender may use any of those Security Associations to protect the packet. Authentication Algorithm - This signifies the authentication algorithm to be used with the IS-IS SA. At present, the following values are possible: HMAC-SHA-1, HMAC-SHA-224, HMAC-SHA-256, HMAC- SHA-384, and HMAC-SHA-512. Authentication Key - This value denotes the cryptographic authentication key associated with the IS-IS SA. The length of this key is variable and depends upon the authentication algorithm specified by the IS-IS SA. 5.4. BFD SA The BFD protocol does not include an in-band mechanism to create or manage BFD Security Associations (BFD SA). A BFD SA contains a set of shared parameters between any two legitimate BFD routers. Parameters associated with a BFD SA: [draft-bhatia-bfd-crypto-auth] Authentication Key Identifier (Key ID) - This is a two octet unsigned integer used to uniquely identify the BFD SA, as manually configured by the network operator (or, in the future, possibly by some key management protocol specified by the IETF). The receiver determines the active SA by looking at this field in the incoming packet. The Wei, et al. Expires January 6, 2011 [Page 12] Internet-Draft analysis-rp-sa July 2010 sender puts this Key ID in the BFD packet based on the active configuration. Authentication Algorithm - This indicates the authentication algorithm to be used with the BFD SA. The following values are possible: Keyed MD5, Keyed SHA-1, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA- 384 and HMAC-SHA-512. Authentication Key - This indicates the cryptographic key associated with this BFD SA. The length of this key is variable and depends upon the authentication algorithm specified by the BFD SA. 5.5. TCP-AO A Master Key Tuple (MKT) describes TCP-AO properties to be associated with one or more connections. It is composed of the following: [ietf-tcpm-tcp-auth-opt] IDs - The values used in the KeyID or RNextKeyID of a TCP-AO option; used to differentiate MKTs in concurrent use (KeyID), as well as to indicate when MKTs are ready for use in the opposite direction (RNextKeyID). Each MKT has two IDs - a SendID and a RecvID. The SendID is inserted as the KeyID of the TCP-OP option of outgoing segments, and the RecvID is matched against the KeyID of the TCP-AO option of incoming segments. MKT IDs MUST support any value, 0-255 inclusive. There are no reserved ID values. Master key - A byte sequence used for generating traffic keys, this may be derived from a separate shared key by an external protocol over a separate channel. Implementations are advised to keep master key values in a private, protected area of memory or other storage. Key Derivation Function (KDF) - Indicates the key derivation function and its parameters, as used to generate traffic keys from master keys. Message Authentication Code (MAC) algorithm - Indicates the MAC algorithm and its parameters as used for this connection. Wei, et al. Expires January 6, 2011 [Page 13] Internet-Draft analysis-rp-sa July 2010 6. References [ietf-karp-design-guide] Lebovitz, G. and M. Bhatia, "Keying and Authentication for Routing Protocols (KARP) Design Guidelines", February 2010. [ietf-karp-threats-req] Lebovitz, G., "KARP Threats and Requirements", February 2010. [ietf-tcpm-tcp-auth-opt] Touch, J., Mankin, A., and R. Al., "The TCP Authentication Option", January 2010. [draft-bhatia-bfd-crypto-auth] Bhatia, M. and V. Manral, "Generic Cryptographic Authentication", June 2010. [RFC4822] Atkinson, R. and M. Fanto, "RIPv2 Cryptographic Authentication", February 2007. [RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", December 2005. [RFC5310] Bhatia, M., Manral, V., Li, T., Atkinson, R., White, R., and M. Fanto, "IS-IS Generic Cryptographic Authentication", February 2009. [RFC5709] Bhatia, M., Manral, V., Fanto, M., White, R., Li, T., and R. Atkinson, "OSPFv2 HMAC-SHA Cryptographic Authentication", October 2009. [RFC4552] Gupta, M. and N. Melam, "Authentication/Confidentiality for OSPFv3", June 2006. [RFC2385] Heffernan, A., "Protection of BGP Sessions via the TCP MD5 Signature Option", August 1998. Wei, et al. Expires January 6, 2011 [Page 14] Internet-Draft analysis-rp-sa July 2010 Authors' Addresses Yinxing Wei (editor) ZTE Corporation No. 68, Zijinghua Road, Yuhuatai District Nanjing, Jiangsu 210012 China Phone: +86 25 52877993 Email: wei.yinxing@zte.com.cn Hongyan Wang ZTE Corporation No. 68, Zijinghua Road, Yuhuatai District Nanjing, Jiangsu 210012 China Phone: +86 25 52877993 Email: wang.hongyan4@zte.com.cn Xiaoping ZTE Corporation No. 68, Zijinghua Road, Yuhuatai District Nanjing, Jiangsu 210012 China Phone: +86 25 52877993 Email: liang.xiaoping@zte.com.cn Wei, et al. Expires January 6, 2011 [Page 15]