RFC 3567 (rfc3567) - Page 2 of 6
Intermediate System to Intermediate System (IS-IS) Cryptographic Authentication
Alternative Format: Original Text Document
RFC 3567 IS-IS Cryptographic Authentication July 2003
reserved, type 1 indicates a cleartext password, and type 255 is used
for routing domain private authentication methods. The remainder of
the TLV value is known as the Authentication Value.
This document extends the above situation by allocating a new
authentication type for HMAC-MD5 and specifying the algorithms for
the computation of the Authentication Value. This document also
describes modifications to the base protocol to ensure that the
authentication mechanisms described in this document are effective.
This document is a publication of the IS-IS Working Group within the
IETF, and is a contribution to ISO IEC JTC1/SC6, for eventual
inclusion with ISO 10589.
2. Authentication Procedures
The authentication type used for HMAC-MD5 is 54 (0x36). The length
of the Authentication Value for HMAC-MD5 is 16, and the length field
in the TLV is 17.
The HMAC-MD5 algorithm requires a key K and text T as input [2]. The
key K is the password for the PDU type, as specified in ISO 10589.
The text T is the IS-IS PDU to be authenticated with the
Authentication Value field inside of the Authentication Information
TLV set to zero. Note that the Authentication Type is set to 54 and
the length of the TLV is set to 17 before authentication is computed.
When LSPs are authenticated, the Checksum and Remaining Lifetime
fields are set to zero (0) before authentication is computed. The
result of the algorithm is placed in the Authentication Value field.
When calculating the HMAC-MD5 result for Sequence Number PDUs, Level
1 Sequence Number PDUs SHALL use the Area Authentication string as in
Level 1 Link State PDUs. Level 2 Sequence Number PDUs shall use the
domain authentication string as in Level 2 Link State PDUs. IS-IS
HELLO PDUs SHALL use the Link Level Authentication String, which MAY
be different from that of Link State PDUs. The HMAC-MD5 result for
the IS-IS HELLO PDUs SHALL be calculated after the Packet is padded
to the MTU size, if padding is not disabled. Implementations that
support the optional checksum for the Sequence Number PDUs and IS-IS
HELLO PDUs MUST NOT include the Checksum TLV.
To authenticate an incoming PDU, a system should save the values of
the Authentication Value field, the Checksum and the Remaining
Lifetime field, set these fields to zero, compute authentication, and
then restore the values of these fields.
Li & Atkinson Informational