J.W. Atwood PIM WG 2010/03/23 bill@cse.concordia.ca The KARP Working Group J.W. Atwood PIM WG 2010/03/23 bill@cse.concordia.ca

History Unwanted Internet Traffic IAB Workshop - March 2006 RFC 4948 Identified securing the routing protocols’ packets on the wire as a goal Agreement between Security ADs and Routing ADs: Define a roadmap

Keying and Authentication for Routing Protocols (KARP) Two BoFs Working Group just before IETF-77 Scope Message Authentication Packet Integrity Possible later: privacy and non-repudiation

Design Choices Change completely Change slowly Run everything inside IPsec Change slowly Accept what is there and strengthen it Design mechanisms to make it easier to manage

Planned Approach Enhance the routing protocols’ current authentication mechanisms For example, the PIM-SM linklocal work Define one or more Key Management Protocols Create and manage the session keys The framework must accept manual keying as one possibility

Incremental Approach Crawl, Walk, Run Some existing routers will not be able to run new functionality New functionality alters the routing performance balance and this may not be acceptable Security ADs have agreed to accept less than the “perfect” solution (for now)

Current Documents Threat Analysis and Requirements Design Guidelines draft-ietf-karp-threats-reqs Design Guidelines draft-ietf-karp-design-guide Framework draft-ietf-karp-framework

Step 1 KeyStore Configured PSK Traffic Keys Basic Routing Proto Define protected elements Strong algos Algo agility Secure use of simple PSK’s Inter-conn. replay protection Intra-conn. replay protection Change parameters forces change of traffic keys Use new key within a connection without data loss Efficient re-keying Prevent in-scope DoS Support manual keying All for future use of KMP KeyStore Configured PSK Traffic Keys Basic Routing Proto

Step 2 ID’s KMP Function Proof of ID’s KeyStore Layer in KMP Define Identifier types/formats Define ID proof mechanisms Re-use KeyStore Re-use Routing Proto’s Manual key structure Common Elements: KeyStore KeyStore-to-Routing Proto API KMP-to-KeyStore API KMP-to-Routing Proto API KMP Function KMP-to- KeyStore API Manual Keyset KeyStore KMP-to-Routing Proto API KeyStore-to- Routing Proto API Common Auth Mechanisms/I.F.’s Traffic Keys Basic Routing Protos

Questions?