Authentication and Confidentiality in Protocol Independent Multicast Sparse Mode (PIM-SM) Link-Local Messages

Abstract

RFC 4601 mandates the use of IPsec to ensure authentication of the link-local messages in the Protocol Independent Multicast -Sparse Mode (PIM-SM) routing protocol. This document specifies mechanisms to authenticate the PIM-SM link-local messages using the IP security (IPsec) Encapsulating Security Payload (ESP) or (optionally) the Authentication Header (AH). It specifies optional mechanisms to provide confidentiality using the ESP. Manual keying is specified as the mandatory and default group key management solution. To deal with issues of scalability and security that exist with manual keying, optional support for an automated group key management mechanism is provided. However, the procedures for implementing automated group key management are left to other documents. This document updates RFC 4601.

Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised)

“…This "pseudo-header" is prepended to the PIM header for the purposes of calculating the checksum. The "Upper-Layer Packet Length" in the pseudo-header is set to the length of the PIM message, except in Register messages where it is set to the length of the PIM register header (8). The Next Header value used in the pseudo-header is 103.…”

“…The reader is referred to [8], [14], and [15] for further discussion of PIM-SM and multicast security.…”

Survey Report on Protocol Independent Multicast - Sparse Mode (PIM-SM) Implementations and Deployments

“…For at least one of them, IPsec is not part of the PIM implementation itself --one just configures IPsec with Security Policy Databases (SPDs) where interface, the ALL_PIM_ROUTERS multicast address, etc., can be used as selectors, according to [RFC5796].…”

Automated Key Management for Router Updates

“…Therefore the implementations must use manually configured keys with the same SA parameters for both inbound and outbound SAs. ' A similar set of procedures is specified for PIM-SM in [6]. However, the PIM-SM document recognizes the potential for automated key management in future specifications.…”

“…For a specific example of these patterns in the case of PIM-SM, see [6]. This "group per speaker" model forms the basis for our proposed system architecture.…”