IS-IS Cryptographic Authentication
obsoletes
- rfc-3567 — Intermediate System to Intermediate System (IS-IS) Cryptographic Authentication
updated by
- rfc-6232 — Purge Originator Identification TLV for IS-IS
- rfc-6233 — IS-IS Registry Extension for Purges
updates
- rfc-1195 — Use of OSI IS-IS for routing in TCP/IP and dual environments
Extracted elements (19)
A counter should be kept on the case where an IS-IS process increases its own LSP Sequence Number due to an inbound LSP authentication failure with higher sequence number, because this scenario could also be triggered by an active attack by an adversary.
Adding a Key-ID field (similar to OSPFv2 and RIPv2) was considered and rejected. The existing mechanism was already widely implemented since 1999 and widely deployed, and the improvement from a revised mechanism was not large enough to justify the change given the installed base.
Full digital signatures (RFC 2154) were considered for stronger authentication but rejected because the computational burden was believed to be much higher than reasonable given the current threat environment in operational commercial networks.
An implementation MAY check a set of passwords when verifying the Authentication Value, providing a mechanism for incrementally changing passwords in a network. An implementation that does not implement HMAC-MD5 authentication MAY accept a PDU that contains the HMAC-MD5 Authentication Type.
An implementation MAY have a transition mode where it includes HMAC-MD5 Authentication Information in PDUs but does not verify the HMAC-MD5 Authentication Information, to aid networks in the process of deploying authentication.
After password rollover, if an inbound LSP with an authentication failure has the local System ID and a higher Sequence Number than the IS-IS process has, the IS-IS process SHOULD increase its own LSP Sequence Number accordingly and re-flood the LSPs.
An implementation that implements HMAC-MD5 authentication and receives HMAC-MD5 Authentication Information MUST discard the PDU if the Authentication Value is incorrect.
Implementations SHOULD support, at minimum, a key composed of a string of printable ASCII of 80 bytes or less, as this is current practice for key configuration.
ISes implementing HMAC-MD5 authentication and initiating LSP purges MUST remove the body of the LSP and add the authentication TLV. ISes MUST NOT accept unauthenticated purges, and MUST NOT accept purges that contain TLVs other than the authentication TLV.
Level 1 Sequence Number PDUs SHALL use the Area Authentication string (as in Level 1 LSPs), and Level 2 Sequence Number PDUs SHALL use the domain authentication string (as in Level 2 LSPs). IS-IS Hello PDUs SHALL use the Link Level Authentication String.
The HMAC-MD5 result for IS-IS Hello PDUs SHALL be calculated after the packet is padded to the MTU size, if padding is not disabled. Implementations supporting optional checksums for SNPs and Hello PDUs MUST NOT include the Checksum TLV.
When computing HMAC-MD5 for LSPs, the Checksum and Remaining Lifetime fields MUST be set to zero before authentication is computed. The Authentication Value field is also set to zero before computation, with the Authentication Type set to 54 and TLV length set to 17.
IS-IS authentication information is encoded as a Type-Length-Value (TLV) tuple with type 10. The first octet of the value specifies the authentication type: 0 is reserved, 1 indicates cleartext password, 54 (0x36) indicates HMAC-MD5, and 255 is for routing domain private authentication methods.
IANA created the 'IS-IS Authentication Type Codes for TLV 10' registry, managed under Designated Expert policy. Initial values: 0 (Reserved), 1 (Cleartext Password), 2 (ISO 10589 Reserved), 54 (HMAC-MD5 Authentication), 255 (Routing Domain private authentication method).
Despite Dobbertin's attacks on MD5 and Wang/Yu's work, there are no published attacks on Keyed-MD5 or HMAC-MD5 as of the document's publication. Bellare's proofs indicate published issues with MD5 do not create an attack on HMAC-MD5 as used in this specification.
Security quality depends entirely on the strength of the authentication algorithms, the strength of the key, correct implementation, and keeping the IS-IS Authentication Key confidential by all parties. If any of these are incorrect or insufficiently secure, no real security is provided.
The HMAC-MD5 mechanism does not prevent replay attacks; however, in most cases such attacks would trigger existing IS-IS protocol mechanisms that effectively reject old information. The mechanism provides improved security against passive attacks compared to cleartext password authentication.
The purge restrictions (removing LSP body, disallowing unauthenticated purges, disallowing purges with extra TLVs) are necessary to prevent a hostile system from receiving an LSP, setting Remaining Lifetime to zero, and flooding it to initiate a purge without knowing the authentication password.
The HMAC-MD5 authentication type code is 54 (0x36). The Authentication Value field for HMAC-MD5 is 16 bytes (the HMAC-MD5 output), making the total TLV length field value 17 (1 byte for auth type + 16 bytes for auth value).