Keying and Authentication for Routing Protocols (KARP) Overview, Threats, and Requirements

Abstract

Different routing protocols employ different mechanisms for securing protocol packets on the wire. While most already have some method for accomplishing cryptographic message authentication, in many cases the existing methods are dated, vulnerable to attack, and employ cryptographic algorithms that have been deprecated. The "Keying and Authentication for Routing Protocols" (KARP) effort aims to overhaul and improve these mechanisms. This document does not contain protocol specifications. Instead, it defines the areas where protocol specification work is needed. This document is a companion document to RFC 6518, "Keying and Authentication for Routing Protocols (KARP) Design Guidelines"; together they form the guidance and instruction KARP design teams will use to review and overhaul routing protocol transport security. Status of This Memo This document is not an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6862. Lebovitz, et al.

The Keying and Authentication for Routing Protocol (KARP) IS-IS Security Analysis

“…This section focuses on where the IS-IS protocol fails to meet general requirements as specified in the threats and requirements document [RFC6862].…”

“…This document also analyzes various threats to IS-IS (as described in [RFC6862]), lists security gaps, and provides specific recommendations to thwart the threats for both manual keying and automated key management mechanisms.…”

Analysis of Bidirectional Forwarding Detection (BFD) Security According to the Keying and Authentication for Routing Protocols (KARP) Design Guidelines

“…There are several requirements described in Section 4 of [RFC6862] that BFD, as defined in BFD [RFC5880], does not currently meet:…”

Analysis of OSPF Security According to the Keying and Authentication for Routing Protocols (KARP) Design Guide

“…However, some gaps remain between the current state and the requirements for manually keyed routing security expressed in [RFC6862]. This document explores these gaps and proposes directions for addressing the gaps.…”

“…There are a number of requirements described in Section 3 of [RFC6862] that OSPF does not currently meet. The gaps are as follows:…”