RFC 2082 (rfc2082) - Page 2 of 12

RIP-2 MD5 Authentication

RFC 2082                RIP-2 MD5 Authentication            January 1997


   MUST NOT

      This phrase means that the item is an absolute prohibition of this
      specification.

   SHOULD

      This word or the adjective "RECOMMENDED" means that there may
      exist valid reasons in particular circumstances to ignore this
      item, but the full implications should be understood and the case
      carefully weighed before choosing a different course.

   SHOULD NOT

      This phrase means that there may exist valid reasons in particular
      circumstances when the listed behavior is acceptable or even
      useful, but the full implications should be understood and the
      case carefully weighed before implementing any behavior described
      with this label.

   MAY
      This word or the adjective "OPTIONAL" means that this item is
      truly optional.  One vendor may choose to include the item because
      a particular marketplace requires it or because it enhances the
      product, for example; another vendor may omit the same item.

2.  Introduction

   Growth in the Internet has made us aware of the need for improved
   authentication of routing information.  RIP-2 provides for
   unauthenticated service (as in classical RIP), or password
   authentication.  Both are vulnerable to passive attacks currently
   widespread in the Internet.  Well-understood security issues exist in
   routing protocols [4].  Clear text passwords, currently specified for
   use with RIP-2, are no longer considered sufficient [5].

   If authentication is disabled, then only simple misconfigurations are
   detected.  Simple passwords transmitted in the clear will further
   protect against the honest neighbor, but are useless in the general
   case.  By simply capturing information on the wire - straightforward
   even in a remote environment - a hostile process can learn the
   password and overcome the network.

   We propose that RIP-2 use an authentication algorithm, as was
   originally proposed for SNMP Version 2, augmented by a sequence
   number.  Keyed MD5 is proposed as the standard authentication
   algorithm for RIP-2, but the mechanism is intended to be algorithm-
   independent.  While this mechanism is not unbreakable (no known



Baker & Atkinson            Standards Track