1. J.W. Atwood PIM WG 2010/03/23 bill@cse.concordia.ca
The KARP Working Group
J.W. Atwood
PIM WG
2010/03/23

2. History Unwanted Internet Traffic
IAB Workshop - March 2006
RFC 4948
Identified securing the routing protocols’ packets on the wire as a goal
Agreement between Security ADs and Routing ADs:
Define a roadmap

3. Keying and Authentication for Routing Protocols (KARP)
Two BoFs
Working Group just before IETF-77
Scope
Message Authentication
Packet Integrity
Possible later: privacy and non-repudiation

4. Design Choices Change completely Change slowly
Run everything inside IPsec
Change slowly
Accept what is there and strengthen it
Design mechanisms to make it easier to manage

5. Planned Approach
Enhance the routing protocols’ current authentication mechanisms
For example, the PIM-SM linklocal work
Define one or more Key Management Protocols
Create and manage the session keys
The framework must accept manual keying as one possibility

6. Incremental Approach Crawl, Walk, Run
Some existing routers will not be able to run new functionality
New functionality alters the routing performance balance and this may not be acceptable
Security ADs have agreed to accept less than the “perfect” solution (for now)

7. Current Documents Threat Analysis and Requirements Design Guidelines
draft-ietf-karp-threats-reqs
Design Guidelines
draft-ietf-karp-design-guide
Framework
draft-ietf-karp-framework

8. Step 1 KeyStore Configured PSK Traffic Keys Basic Routing Proto
Define protected elements
Strong algos
Algo agility
Secure use of simple PSK’s
Inter-conn. replay protection
Intra-conn. replay protection
Change parameters forces change of traffic keys
Use new key within a connection without data loss
Efficient re-keying
Prevent in-scope DoS
Support manual keying
All for future use of KMP
KeyStore
Configured PSK
Traffic Keys
Basic Routing Proto

9. Step 2 ID’s KMP Function Proof of ID’s KeyStore
Layer in KMP
Define Identifier types/formats
Define ID proof mechanisms
Re-use KeyStore
Re-use Routing Proto’s Manual key structure
Common Elements:
KeyStore
KeyStore-to-Routing Proto API
KMP-to-KeyStore API
KMP-to-Routing Proto API
KMP Function
KMP-to-
KeyStore
API
Manual
Keyset
KeyStore
KMP-to-Routing Proto API
KeyStore-to-
Routing Proto API
Common Auth
Mechanisms/I.F.’s
Traffic Keys
Basic Routing Protos

10. Questions?