From 5b75cf0763d3ff14803118f94dc7008f9a7525cb Mon Sep 17 00:00:00 2001 From: Randy Bush Date: Thu, 27 Mar 2025 13:31:29 -0700 Subject: [PATCH] more secdir updates --- draft-ietf-lsvr-l3dl.xml | 158 +++++++++++++++++++++------------------ 1 file changed, 86 insertions(+), 72 deletions(-) diff --git a/draft-ietf-lsvr-l3dl.xml b/draft-ietf-lsvr-l3dl.xml index 226b8d5..a29c095 100644 --- a/draft-ietf-lsvr-l3dl.xml +++ b/draft-ietf-lsvr-l3dl.xml @@ -10,14 +10,14 @@ - + Layer-3 Discovery and Liveness - Arrcus & Internet Initiative Japan + Arrcus & IIJ Research Lab
5147 Crystal Springs @@ -448,7 +448,7 @@ congestion is not considered a sufficiently significant risk to warrant additional complexity. - Should a PDU need to be retransmitted, it MUST BE sent as the + Should a PDU need to be retransmitted, it MUST be sent as the identical Datagram set as the original transmission. The Transmission Sequence Number informs the receiver that it is the same PDU. @@ -483,7 +483,7 @@ Eight-bit Version number of the protocol, - currently 0. Values other than 0 MUST BE treated as an error. + currently 0. Values other than 0 MUST be treated as an error. The protocol version needs to be in one and only one place, so it is in the datagram as opposed to, for example, the PDU header. @@ -514,7 +514,7 @@ bit flips, see . If a Datagram fails checksum verification, the datagram is - invalid and SHOULD be silently discarded. The sender will + invalid and MUST be silently discarded. The sender will retransmit the PDU, and the receiver can assemble it. The PDU being transported or a fragment @@ -609,7 +609,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) Datagrams, see .
@@ -621,7 +621,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ | Payload ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| Sig Type | Signature Length | ~ +| Sig Algo | Signature Length | ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + ~ Signature ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -640,23 +640,23 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) The application layer content of the L3DL PDU. - The type of the Signature, see The type of the Signature, see . Type 0, a null signature, is defined in this document. - Sig Type 0 indicates a null Signature. For a trivial PDU such + Sig Algo 0 indicates a null Signature. For a trivial PDU such as KEEPALIVE, the underlying Datagram checksum may be sufficient for integrity, though it lacks authenticity. - Other Sig Types may be defined in other documents, cf. Other Sig Algos may be defined in other documents, cf. . The length of the Signature, - possibly including padding, in octets. If Sig Type is 0, - Signature Length MUST BE 0. + possibly including padding, in octets. If Sig Algo is 0, + Signature Length MUST be 0. The result of running the signature - algorithm specified in Sig Type over all octets of the PDU except + algorithm specified in Sig Algo over all octets of the PDU except for the Signature itself. @@ -773,7 +773,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) network noise and adjust the inter-HELLO timer accordingly.
@@ -783,7 +783,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PDU Type = 0 | Payload Length = 0 ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ | Sig Type = 0 | Signature Length = 0 | +~ | Sig Algo = 0 | Signature Length = 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
@@ -817,11 +817,11 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) Each device has learned the other's MAC Address from the HELLO exchange, see . Therefore the OPEN and all - subsequent PDUs MUST BE unicast, as opposed to the HELLO's multicast + subsequent PDUs MUST be unicast, as opposed to the HELLO's multicast frame.
@@ -843,7 +843,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Serial Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| Sig Type | Signature Length | Signature ... | +| Sig Algo | Signature Length | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
@@ -876,11 +876,11 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) Key Length is a 16-bit field denoting the length in octets of the Key itself, not including the Auth Type or the Key Length. If the Auth Type is zero, then the Key Length MUST also be zero, and there - MUST BE no Key data. + MUST be no Key data. The Key is specific to the operational environment. A failure to authenticate is a failure to start the L3DL session, an ERROR PDU - MUST BE sent (Error Code 3), and HELLOs MUST be restarted. + MUST be sent (Error Code 3), and HELLOs MUST be restarted. Although delay and jitter in responding with an OPEN were specified above, beware of load created by long strings of @@ -914,6 +914,15 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) sent in the OPEN. If the sender is not trying to resume a dropped session, the Serial Number MUST be zero. + To prevent downgrade attacks, in an OPEN PDU which is resuming a + session, the Signature Type MUST be either the same as that of the + previous successful OPEN or MAY be ugraded from TOFU to PKI (value + 2), assuming a Certificate has been configured. + + Similarly, to prevent downgrade attacks, an OPEN PDU which is + resuming a session, MUST use the same Auth Type as that of the + previously successful OPEN. + If the receiver of an OPEN PDU with a non-zero Serial Number can not resume from the requested point, it should return an ACK with an Error Code of 2, Session could not be continued. The sender of the @@ -935,15 +944,16 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) an unacknowledged OPEN PDU, like other ACKed PDUs, SHOULD use exponential back-off, see . - If a properly authenticated OPEN arrives at L3DL speaker A with a - new Nonce from an LLEI, speaker B, with which A believes it already - has an L3DL session (OPENs have already been exchanged), and the - Serial Number in the OPEN PDU is non-zero, speaker A SHOULD - establish a new sending session by sending an OPEN with the Serial - Number being the same as that of A's last sent and ACKed PDU. A - MUST resume sending encapsulations etc. subsequent to the requested - Sequence Number. And B MUST retain all previously discovered - encapsulation and other data received from A. + If a properly authenticated OPEN (see arrives at L3DL speaker A with a new + Nonce from an LLEI, speaker B, with which A believes it already has + an L3DL session (OPENs have already been exchanged), and the Serial + Number in the OPEN PDU is non-zero, speaker A SHOULD establish a new + sending session by sending an OPEN with the Serial Number being the + same as that of A's last sent and ACKed PDU. A MUST resume sending + encapsulations etc. subsequent to the requested Sequence Number. + And B MUST retain all previously discovered encapsulation and other + data received from A. If a properly authenticated OPEN arrives with a new Nonce from an LLEI with which the receiving logical link endpoint believes it @@ -959,7 +969,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n)
The ACK PDU acknowledges receipt of a PDU and reports any error @@ -974,7 +984,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ | ACKed PDU | EType | Error Code | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| Error Hint | Sig Type |Signature Leng.~ +| Error Hint | Sig Algo |Signature Leng.~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1073,7 +1083,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) The header for all encapsulation PDUs is as follows:
@@ -1087,7 +1097,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Serial Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| Encapsulation List... | Sig Type | +| Encapsulation List... | Sig Algo | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Signature Length | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1187,7 +1197,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) interface's addresses and the corresponding prefix lengths.
@@ -1203,7 +1213,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Encaps Flags | IPv4 Address ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ | PrefixLen | more ... | Sig Type | +~ | PrefixLen | more ... | Sig Algo | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Signature Length | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1223,7 +1233,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) lengths.
@@ -1245,7 +1255,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) + + | IPv6 Address | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| | PrefixLen | more ... | Sig Type | +| | PrefixLen | more ... | Sig Algo | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Signature Length | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1294,7 +1304,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) each address.
@@ -1312,7 +1322,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ IPv4 Address | PrefixLen | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| more ... | Sig Type | Signature Length | +| more ... | Sig Algo | Signature Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Signature | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1332,7 +1342,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) lengths, and the corresponding labels which will be accepted for each address.
@@ -1356,7 +1366,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) + +-+-+-+-+-+-+-+-+ | | Prefix Len | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| more ... | Sig Type | Signature Length | +| more ... | Sig Algo | Signature Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1377,7 +1387,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) PDU is defined as follows:
@@ -1389,7 +1399,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ | ULPC Type | AttrCount | ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ Attribute List ... | Sig Type | Signature Len ~ +~ Attribute List ... | Sig Algo | Signature Len ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1473,7 +1483,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) Attribute may be used to signal preferences. If a peering address has been announced as a loopback, - i.e. MUST BE flagged as such in the L3DL Encapsulation PDU (see + i.e. MUST be flagged as such in the L3DL Encapsulation PDU (see ), a two or three hop BGP session will be established. Otherwise a direct one hop session is used. The BGP session to a loopback will forward to @@ -1588,10 +1598,9 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) The BGP Authentication sub-TLV provides any authentication data needed to OPEN the BGP session. Depending on operator configuration of the environment, it might be a simple MD5 key - (see ), the name of a key chain in a - KARP database (see ), or one of multiple - Authentication sub-TLVs to support . + (see ), or the name of a key chain in a + KARP database (see ), or data to support + other BGP authentication algorithms.
@@ -1672,7 +1681,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Ent Type | Enterprise Data ... ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ | Sig Type | Signature Length | +~ | Sig Algo | Signature Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Signature ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -1696,7 +1705,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n)
@@ -1706,7 +1715,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PDU Type = 2 | Payload Length = 0 ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ | Sig Type = 0 | Signature Length = 0 | +~ | Sig Algo = 0 | Signature Length = 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
@@ -1716,7 +1725,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) configurable, with a default of ten seconds. A receiver may choose to ignore KEEPALIVE PDUs. - An operational deployment MUST BE configured whether to use + An operational deployment MUST be configured whether to use KEEPALIVEs or not, either globally, or as finely as to per-link granularity. Disagreement MAY result in repeated session failure and reestablishment. @@ -1894,6 +1903,10 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) session. A mechanism for 'rolling' from the current public key to a fresh one is described in . + While trust anchor maintenance is a bit beyond the scope of + this document, Section 4.4 of may be + applicable. +
To avoid the creation of yet another IANA registry for @@ -1971,11 +1984,11 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) Verify that the PDU is syntactically correct, and extract - the Auth Type, Key, Sig Type, and Signature fields. + the Auth Type, Key, Sig Algo, and Signature fields. - Verify that Auth Type and Sig Type refer to the same + Verify that Auth Type and Sig Algo refer to the same algorithm suite, and that said algorithm suite is one that the implementation understands. @@ -2029,11 +2042,11 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) Verify that the PDU is syntactically correct, and extract - the Sig Type and Signature fields. + the Sig Algo and Signature fields. - Verify that Sig Type refers to the same algorithm suite as + Verify that Sig Algo refers to the same algorithm suite as the Auth Type recorded during verification of the OPEN PDU. @@ -2188,7 +2201,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) also signs the new public key to create a new L3DL certificate.
@@ -2308,15 +2321,16 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) session being alive. As the ULPC PDU may contain keying material, see , it SHOULD BE signed. + target="bgpmd5"/>, it MUST be signed. Any keying material in the PDU SHOULD BE salted and hashed. - The BGP Authentication sub-TLV provides for provisioning MD5, - which is a quite weak hash, horribly out of fashion, and kills + The BGP Authentication sub-TLV provides describes provisioning + MD5, which is a quite weak hash, horribly out of fashion, and kills puppies. But, like it or not, it has been sufficient against the kinds of attacks BGP TCP sessions have endured. So it is what BGP - deployments use. + deployments use. The BGP Authentication sub-TLV is actually + algorithm agnostic; so other/better alorithms are encouraged. The TOFU method requires a leap of faith to accept the key in the OPEN PDU, as it can not be verified against any authority. Hence it @@ -2337,8 +2351,8 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) one draws the line between rigidity, flexibility, and security varies. - The REKEY PDU is open to abuse to create a signature algorithm - downgrade attack. + The NEWKEY PDU is open to abuse to create a signature algorithm + or Auth Type downgrade attack. If L3DL is used in a WAN deployment, as opposed to tightly controlled data center, the use SHOULD be restricted to iBGP peers @@ -2355,7 +2369,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) This document requests the IANA create a registry for L3DL PDU Type, which may range from 0 to 255. The name of the registry should be L3DL-PDU-Type. The policy for adding to the registry is - RFC Required per , either standards track or + RFC Required per , either standards track or experimental. The initial entries should be the following:
@@ -2384,7 +2398,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) This document requests the IANA create a registry for L3DL ULPC Type, which may range from 0 to 255. The name of the registry should be L3DL-ULPC-Type. The policy for adding to the registry is - RFC Required per , either standards track or + RFC Required per , either standards track or experimental. The initial entries should be the following:
@@ -2401,9 +2415,9 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n)
This document requests the IANA create a registry for L3DL - Signature Type, AKA Sig Type, which may range from 0 to 255. The + Signature Type, AKA Sig Algo, which may range from 0 to 255. The name of the registry should be L3DL-Signature-Type. The policy for - adding to the registry is RFC Required per , + adding to the registry is RFC Required per , either standards track or experimental. The initial entries should be the following:
@@ -2424,7 +2438,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) This document requests the IANA create a registry for L3DL PL Flag Bits, which may range from 0 to 7. The name of the registry should be L3DL-PL-Flag-Bits. The policy for adding to the registry is - RFC Required per , either standards track or + RFC Required per , either standards track or experimental. The initial entries should be the following:
@@ -2445,7 +2459,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) This document requests the IANA create a registry for L3DL Error Codes, a 16 bit integer. The name of the registry should be L3DL-Error-Codes. The policy for adding to the registry is RFC - Required per , either standards track or + Required per , either standards track or experimental. The initial entries should be the following:
@@ -2500,10 +2514,10 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) - + @@ -2553,7 +2567,7 @@ uint32_t sbox_checksum_32(const uint8_t *b, const size_t n) - +