One document matched: draft-ietf-bfd-hmac-sha-00.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="std" docName="draft-ietf-bfd-hmac-sha-00" ipr="trust200902">
<front>
<title abbrev="BFD HMAC-SHA">Authenticating BFD using HMAC-SHA-2
procedures</title>
<author fullname="Dacheng Zhang" initials="D." surname="Zhang">
<organization>Huawei</organization>
<address>
<postal>
<street></street>
<city>Beijing</city>
<region></region>
<code></code>
<country>China</country>
</postal>
<email>zhangdacheng@huawei.com</email>
</address>
</author>
<author fullname="Manav Bhatia " initials="M." surname="Bhatia ">
<organization>Alcatel-Lucent</organization>
<address>
<postal>
<street></street>
<city>Bangalore</city>
<country>India</country>
</postal>
<email>manav.bhatia@alcatel-lucent.com</email>
</address>
</author>
<author fullname="Vishwas Manral " initials="V. " surname="Manral ">
<organization>Hewlett-Packard Co.</organization>
<address>
<postal>
<street>19111 Pruneridge Ave.</street>
<city>Cupertino</city>
<region>CA</region>
<code>95014</code>
<country>USA</country>
</postal>
<email>vishwas.manral@hp.com</email>
</address>
</author>
<date day="11" month="January" year="2012" />
<abstract>
<t>This document describes how Hashed Message Authentication Mode (HMAC)
in conjunction with the SHA-256, SHA-384, and SHA-512 algorithms can be
used for authenticating Bidirectional Forwarding Detection (BFD). It
uses the Generic Cryptographic Authentication and Generic Meticulous
Cryptographic Authentication sections to carry the authentication data.
This updates, but does not supercede, the cryptographic authentication
mechanism specified in RFC 5880. </t>
</abstract>
<note title="Requirements Language">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119">RFC 2119</xref>.</t>
</note>
</front>
<middle>
<section title="Introduction">
<t>The cryptographic authentication mechanisms specified in BFD
[RFC5880] defines MD5 [RFC1321] and Secure Hash Algorithm (SHA-1)
algorithms to authenticate BFD packets. The recent escalating series of
attacks on MD5 and SHA-1 [SHA-1-attack1] [SHA-1-attack2] raise concerns
about their remaining useful lifetime [RFC6151] [RFC6194]. </t>
<t>These attacks may not necessarily result in direct vulnerabilities
for Keyed-MD5 and Keyed-SHA-1 digests as message authentication codes
because the colliding message may not correspond to a syntactically
correct BFD protocol packet. Regardless, there is a need felt to
deprecate MD5 and SHA-1 as the basis for the HMAC algorithm in favor of
stronger digest algorithms. </t>
<t>This document adds support for Secure Hash Algorithms (SHA) defined
in the US NIST Secure Hash Standard (SHS), which is defined by NIST FIPS
180-2 [FIPS-180-2]. [FIPS-180-2] includes SHA-1, SHA-224, SHA- 256,
SHA-384, and SHA-512. The HMAC authentication mode defined in NIST FIPS
198 is used [FIPS-198]. </t>
<t>It is believed that [RFC2104] is mathematically identical to
[FIPS-198] and it is also believed that algorithms in [RFC6234] are
mathematically identical to [FIPS-180-2]. </t>
<t>It should be noted that if SHA-1 is used in the HMAC construction
then collision attacks currently known against SHA-1 do not apply. The
new attacks on SHA-1 have no impact on the security of HMAC-SHA-1. NIST
will be supporting HMAC-SHA-1 even after 2010 [NIST-HMAC-SHA] , whereas
it would be dropping support for SHA-1 in digital signatures. </t>
<t>[I-D.ietf-bfd-generic-crypto-auth] defines new authentication types -
Generic Cryptographic Authentication and Generic Meticulous
Cryptographic Authenticationan extension that can be used for carrying
the authentication digests defined in this document. </t>
<t>Implementations of this specification must include support for at
least HMAC-SHA-256 and may include support for either of HMAC-SHA-384 or
HMAC-SHA-512. </t>
</section>
<section title="Cryptographic Aspects ">
<t>In the algorithm description below, the following nomenclature, which
is consistent with [FIPS-198], is used:</t>
<t>H is the specific hashing algorithm (e.g. SHA-256).</t>
<t>K is the password for the BFD packet.</t>
<t>Ko is the cryptographic key used with the hash algorithm.</t>
<t>B is the block size of H, measured in octets rather than bits. Note
that B is the internal block size, not the hash size. For SHA-1 and
SHA-256: B == 64 For SHA-384 and SHA-512: B == 128 L is the length of
the hash, measured in octets rather than bits.</t>
<t>XOR is the exclusive-or operation.</t>
<t>Opad is the hexadecimal value 0x5c repeated B times.</t>
<t>Ipad is the hexadecimal value 0x36 repeated B times.</t>
<t>Apad is the hexadecimal value 0x878FE1F3 repeated (L/4) times.</t>
<t>(1)Preparation of the Key</t>
<t>In this application, Ko is always L octets long.</t>
<t>If the Authentication Key (K) is L octets long, then Ko is equal to
K. If the Authentication Key (K) is more than L octets long, then Ko is
set to H(K). If the Authentication Key (K) is less than L octets long,
then Ko is set to the Authentication Key (K) with zeros appended to the
end of the Authentication Key (K) such that Ko is L octets long.</t>
<t>(2)First Hash</t>
<t>First, the Authentication Data field in the Generic Authentication
Section is filled with the value Apad and the Authentication Type field
is set to 6 or 7 depending upon which Authentication Type is being used.
The Sequence Number field MUST be set to bfd.XmitAuthSeq.</t>
<t>Then, a first hash, also known as the inner hash, is computed as
follows:</t>
<t>First-Hash = H(Ko XOR Ipad || (BFD Packet))</t>
<t>(3)Second Hash T</t>
<t>Then a second hash, also known as the outer hash, is computed as
follows:</t>
<t>Second-Hash = H(Ko XOR Opad || First-Hash)</t>
<t>(4)Result</t>
<t>The resultant Second-Hash becomes the Authentication Data that is
sent in the Authentication Data field of the BFD Authentication Section.
The length of the Authentication Data field is always identical to the
message digest size of the specific hash function H that is being
used.</t>
<t>This also means that the use of hash functions with larger output
sizes will also increase the size of BFD Packet as transmitted on the
wire.</t>
</section>
<section title="Procedures at the Sending Side ">
<t>Before a BFD device sends a BFD packet out, the device needs to
select an appropriate BFD SA from its local key table if a keyed digest
for the packet is required. If no appropriate SA is avaliable, the BFD
packet MUST be discarded.</t>
<t>If an appropriate SA is avaliable, the device then derives the key
and the associated authentication algorithm (HMAC-SHA-256, HMAC-SHA-384
or HMAC-SHA-512) from the SA.</t>
<t>The device then start performing the operations illustrated in
Section 2. Before the authentication data is computed, the device MUST
fill the Auth Type and the Auth length . The Sequence Number field MUST
be set to bfd.XmitAuthSeq.</t>
<t>The value of Auth Length in the generic authentication section is
various according to different authentication algorithms being used.
Specifically, the value is 40 for HMAC-SHA-256, 56 for HMAC-SHA-384 and
72 for HMAC- SHA-512.</t>
<t>The Key ID is then filled.</t>
<t>After that, the authentication data is computed as illustrated in
Section 3.</t>
<t>The result of the authentication algorithm is placed in the
Authentication data, following the Key ID.</t>
</section>
<section title="Procedure at the Receiving Side ">
<t>Upon receiving a BFD packet with an generic authentication section
appended, the receiving device needs to find an appropriate BFD SA from
its local key table to verify the packet. The SA is located by the Key
ID in the authentication section of the packet.</t>
<t>If there is no SA is associated with the Key ID, the received packet
MUST be discarded.</t>
<t>If bfd.AuthSeqKnown is 1, examine the Sequence Number field. For
Cryptographic Authentication, if the Sequence Number lies outside of the
range of bfd.RcvAuthSeq to bfd.RcvAuthSeq+(3*Detect Mult) inclusive
(when treated as an unsigned 32 bit circular number space), the received
packet MUST be discarded. For Meticulous Cryptographic Authentication,
if the Sequence Number lies outside of the range of bfd.RcvAuthSeq+1 to
bfd.RcvAuthSeq+(3*Detect Mult) inclusive (when treated as an unsigned 32
bit circular number space, the received packet MUST be discarded.</t>
<t>Authentication Algorithm dependent processing, needs to be performed,
using the algorithm specified by the appropriate BFD SA for the received
packet.</t>
<t>Before the device performs any processing, it needs to save the
values of the Authentication Value field.</t>
<t>The device then needs to set the Authentication Value field with Apad
before the authentication data is computed. The calculated data is
compared with the received authentication data in the packet.</t>
<t>The packet MUST be discarded if the calculated data and the received
authentication data do not match each other. In such a case, an error
event SHOULD be logged.</t>
<t>A BFD implementation MAY be in a transition mode where it includes
CRYPTO_AUTH or the MET_CRYPTO_AUTH information in packets but never
verifies it. This is provided as a transition aid for networks in the
process of migrating to the new CRYPTO_AUTH and MET_CRYPTO_AUTH based
authentication schemes.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document makes no request of IANA.</t>
<t>Note to RFC Editor: this section may be removed on publication as an
RFC.</t>
</section>
<section anchor="Security" title="Security Considerations">
<t>The approach described in this document enhances the security of the
BFD protocol by adding, to the existing BFD cryptographic authentication
methods, support for the SHA-2 algorithms defined in the NIST Secure
Hash Standard (SHS) using the HMAC mode. However, the confidentiality
protection for BFD packets is out of scope of this work .</t>
<t>Because all of the currently specified algorithms use symmetric
cryptography, one cannot authenticate precisely which BFD device sent a
given packet. However, one can authenticate that the sender knew the BFD
Security Association (including the BFD SA's parameters) currently in
use.</t>
<t>To enhance system security, the applied keys should be changed
periodically and implementations SHOULD be able to store and use more
than one key at the same time. The quality of the security provided by
the cryptographic authentication option depends completely on the
strength of the cryptographic algorithm and cryptographic mode in use,
the strength of the key being used, and the correct implementation of
the security mechanism in all communicating BFD implementations.
Accordingly, the use of high assurance development methods is
recommended. It also requires that all parties maintain the secrecy of
the shared secret key. <xref target="RFC4086"></xref> provides guidance
on methods for generating cryptographically random bits.</t>
<t>The value Apad is used here primarily for consistency with IETF
specifications for HMAC-SHA authentication of RIPv2 SHA <xref
target="RFC4822"></xref>, IS-IS SHA and OSPF SHA <xref
target="RFC5709"></xref>.</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.RFC.2119"?>
<?rfc include='reference.RFC.6151'?>
<?rfc include='reference.RFC.6194'?>
<?rfc include='reference.RFC.6039'?>
<reference anchor="FIPS-180-2">
<front>
<title>Secure Hash Standard (SHS)</title>
<author fullname="" surname="">
<organization>National Institute of Standards and Technology, FIPS
PUB 180-3</organization>
</author>
<date month="October" year="2008" />
</front>
</reference>
<reference anchor="FIPS-198">
<front>
<title>The Keyed-Hash Message Authentication Code (HMAC)</title>
<author>
<organization>National Institute of Standards and Technology, FIPS
PUB 198</organization>
</author>
<date month="March" year="2002" />
</front>
</reference>
<?rfc include='reference.I-D.ietf-bfd-generic-crypto-auth'?>
</references>
<references title="Informative References">
<?rfc include='reference.I-D.ietf-karp-design-guide'?>
<reference anchor="MD5-attack">
<front>
<title>Collisions for Hash Functions MD4, MD5, HAVAL-128 and
RIPEMD</title>
<author initials="X" surname="Wang">
<organization></organization>
</author>
<author fullname="" initials="D." surname="Feng">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author initials="X." surname="Lai">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author initials="H." surname="Yu">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<date month="August" year="2004" />
</front>
</reference>
<reference anchor="Dobb96a">
<front>
<title>Cryptanalysis of MD5 Compress</title>
<author initials="H." surname="Dobbertin">
<organization></organization>
</author>
<date month="May" year="1996" />
</front>
</reference>
<reference anchor="Dobb96b">
<front>
<title>The Status of MD5 After a Recent Attack", CryptoBytes</title>
<author initials="H." surname="Dobbertin">
<organization></organization>
</author>
<date year="1996" />
</front>
</reference>
<reference anchor="SHA-1-attack1">
<front>
<title>Finding Collisions in the Full SHA-1</title>
<author initials="X." surname="Wang">
<organization></organization>
</author>
<author initials="Y." surname="Yin">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author initials="H." surname="Yu">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<date year="2005" />
</front>
</reference>
<reference anchor="SHA-1-attack2">
<front>
<title>New Collision Search for SHA-1</title>
<author initials="X." surname="Wang">
<organization></organization>
</author>
<author initials="A." surname="Yao">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<author initials="F." surname="Yao">
<organization></organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email></email>
<uri></uri>
</address>
</author>
<date year="2005" />
</front>
</reference>
<reference anchor="NIST-HMAC-SHA">
<front>
<title>NIST's Policy on Hash Functions</title>
<author fullname="National Institute of Standards and Technology, Available online at http://csrc.nist.gov/groups/ST/hash/policy.html"
surname="National Institute of Standards and Technology, Available online at http://csrc.nist.gov/groups/ST/hash/policy.html">
<organization></organization>
</author>
<date year="2006" />
</front>
</reference>
<?rfc include='reference.RFC.2104'?>
<?rfc include='reference.RFC.5880'?>
<?rfc include='reference.RFC.4086'?>
<?rfc include='reference.RFC.4822'?>
<?rfc include='reference.RFC.5310'?>
<?rfc include='reference.RFC.5709'?>
<?rfc include='reference.RFC.6234'?>
<?rfc include='reference.RFC.1321'?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-23 10:10:28 |