Security Extension for OSPFv2 When Using Manual Key Management
RFC 7474, “Security Extension for OSPFv2 When Using Manual Key Management”, is a Proposed Standard document published in April 2015 by M. Bhatia, S. Hartman, D. Zhang, A. Lindem. It updates RFC 2328, RFC 5709. The canonical text is published by the RFC Editor.
Abstract
The current OSPFv2 cryptographic authentication mechanism as defined in RFCs 2328 and 5709 is vulnerable to both inter-session and intra- session replay attacks when using manual keying. Additionally, the existing cryptographic authentication mechanism does not cover the IP header. This omission can be exploited to carry out various types of attacks.
This document defines changes to the authentication sequence number mechanism that will protect OSPFv2 from both inter-session and intra- session replay attacks when using manual keys for securing OSPFv2 protocol packets. Additionally, we also describe some changes in the cryptographic hash computation that will eliminate attacks resulting from OSPFv2 not protecting the IP header.
What “Proposed Standard” means
An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.
The canonical text of RFC 7474 is hosted at rfc-editor.org. Available in TXT,HTML.
- RFC 7473 Controlling State Advertisements of Non-negotiated LDP Applications
- RFC 7475 Increasing the Number of Area Directors in an IETF Area
- RFC 7472 Internet Printing Protocol over HTTPS Transport Binding and the 'ipps' URI Scheme
- RFC 7476 Information-Centric Networking: Baseline Scenarios
- RFC 7471 OSPF Traffic Engineering Metric Extensions
- RFC 7477 Child-to-Parent Synchronization in DNS
- RFC 7470 Conveying Vendor-Specific Constraints in the Path Computation Element Communication Protocol
- RFC 7478 Web Real-Time Communication Use Cases and Requirements