1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
|
<pre>Internet Engineering Task Force (IETF) U. Chunduri
Request for Comments: 7602 W. Lu
Category: Standards Track A. Tian
ISSN: 2070-1721 Ericsson Inc.
N. Shen
Cisco Systems, Inc.
July 2015
<span class="h1">IS-IS Extended Sequence Number TLV</span>
Abstract
This document defines the Extended Sequence Number TLV to protect
Intermediate System to Intermediate System (IS-IS) PDUs from replay
attacks.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in <a href="./rfc5741#section-2">Section 2 of RFC 5741</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="http://www.rfc-editor.org/info/rfc7602">http://www.rfc-editor.org/info/rfc7602</a>.
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
<span class="grey">Chunduri, et al. Standards Track [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
Table of Contents
<a href="#section-1">1</a>. Introduction . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-1.1">1.1</a>. Requirements Language . . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-1.2">1.2</a>. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-2">2</a>. Replay Attacks and Impact on IS-IS Networks . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.1">2.1</a>. IIHs . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.2">2.2</a>. LSPs . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.3">2.3</a>. SNPs . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-3">3</a>. Extended Sequence Number TLV . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-3.1">3.1</a>. Sequence Number Wrap . . . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-4">4</a>. Mechanism and Packet Encoding . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-4.1">4.1</a>. IIHs . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-4.2">4.2</a>. SNPs . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-5">5</a>. Backward Compatibility and Deployment . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-5.1">5.1</a>. IIHs and SNPs . . . . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-6">6</a>. IANA Considerations . . . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-7">7</a>. Security Considerations . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-8">8</a>. References . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-8.1">8.1</a>. Normative References . . . . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-8.2">8.2</a>. Informative References . . . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#appendix-A">Appendix A</a>. ESSN Encoding Mechanisms . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#appendix-A.1">A.1</a>. Using Timestamps . . . . . . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#appendix-A.2">A.2</a>. Using Non-volatile Storage . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#appendix-B">Appendix B</a>. Operational/Implementation Considerations . . . . . <a href="#page-11">11</a>
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
Intermediate System to Intermediate System (IS-IS) [<a href="#ref-ISO10589" title=""Intermediate system to intermediate system intra-domain- routing routine information exchange protocol for use in conjunction with the protocol for providing the connectionless-mode Network Service (ISO 8473)"">ISO10589</a>] has
been adopted widely in various Layer 2 / Layer 3 routing and
switching deployments of data centers and for critical business
operations. Its flexibility and scalability make it well suited for
the rapid development of new data center infrastructures. Also,
while technologies such as Software-Defined Networking (SDN) may
improve network management and enable new applications, their use has
an effect on the security requirements of the routing infrastructure.
A replayed IS-IS PDU can potentially cause many problems in IS-IS
networks, including bouncing adjacencies, blackholing, and even some
form of Denial-of-Service (DoS) attacks as explained in <a href="#section-2">Section 2</a>.
This problem is also discussed in the Security Considerations
section, in the context of cryptographic authentication work as
described in [<a href="./rfc5304" title=""IS-IS Cryptographic Authentication"">RFC5304</a>] and [<a href="./rfc5310" title=""IS-IS Generic Cryptographic Authentication"">RFC5310</a>].
<span class="grey">Chunduri, et al. Standards Track [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
Currently, there is no mechanism to protect IS-IS Hello (IIH) PDUs
and Sequence Number PDUs (SNPs) from replay attacks. However, Link
State PDUs (LSPs) have a sequence number in the LSP header as defined
in [<a href="#ref-ISO10589" title=""Intermediate system to intermediate system intra-domain- routing routine information exchange protocol for use in conjunction with the protocol for providing the connectionless-mode Network Service (ISO 8473)"">ISO10589</a>], with which they can effectively mitigate intra-session
replay attacks. But, LSPs are still susceptible to inter-session
replay attacks.
This document defines the Extended Sequence Number (ESN) TLV to
protect IS-IS PDUs from replay attacks.
The new ESN TLV defined here thwarts these threats and can be
deployed with the authentication mechanisms specified in [<a href="./rfc5304" title=""IS-IS Cryptographic Authentication"">RFC5304</a>]
and [<a href="./rfc5310" title=""IS-IS Generic Cryptographic Authentication"">RFC5310</a>] for a more secure network.
Replay attacks can be effectively mitigated by deploying a group key
management protocol (being developed as defined in [<a href="#ref-GROUP-IKEv2" title=""Group Key Management using IKEv2"">GROUP-IKEv2</a>] and
[<a href="#ref-MRKMP" title=""Multicast Router Key Management Protocol (MaRK)"">MRKMP</a>]) with a frequent key change policy. Currently, there is no
such mechanism defined for IS-IS. Even if such a mechanism is
defined, usage of this TLV can be helpful to avoid replays before the
keys are changed.
Also, it is believed that, even when such a key management system is
deployed, there always will be some systems based on manual keying
that coexist with systems based on key management protocols. The ESN
TLV defined in this document is helpful for such deployments.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Requirements Language</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <a href="./rfc2119">RFC 2119</a> [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>. Acronyms</span>
CSNP - Complete Sequence Number PDU
ESN - Extended Sequence Number
IIH - IS-IS Hello
IS - Intermediate System
LSP - IS-IS Link State PDU
PDU - Protocol Data Unit
<span class="grey">Chunduri, et al. Standards Track [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
PSNP - Partial Sequence Number PDU
SNP - Sequence Number PDU
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Replay Attacks and Impact on IS-IS Networks</span>
Replaying a captured protocol packet to cause damage is a common
threat for any protocol. Securing the packet with cryptographic
authentication information alone cannot mitigate this threat
completely. This section explains the replay attacks and their
applicability to each IS-IS PDU.
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. IIHs</span>
When an adjacency is brought up, an IS sends an IIH packet with an
empty neighbor list (TLV 6); it can be sent with or without
authentication information. Packets can be replayed later on the
broadcast network, and this may cause all ISs to bounce the
adjacency, thus churning the network. Note that mitigating replay is
only possible when authentication information is present.
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>. LSPs</span>
Normal operation of the IS-IS update process as specified in
[<a href="#ref-ISO10589" title=""Intermediate system to intermediate system intra-domain- routing routine information exchange protocol for use in conjunction with the protocol for providing the connectionless-mode Network Service (ISO 8473)"">ISO10589</a>] provides timely recovery from all LSP replay attacks.
Therefore, the use of the extensions defined in this document is
prohibited in LSPs. Further discussion of the vulnerability of LSPs
to replay attacks can be found in [<a href="#ref-ISIS-ANALYSIS">ISIS-ANALYSIS</a>].
<span class="h3"><a class="selflink" id="section-2.3" href="#section-2.3">2.3</a>. SNPs</span>
A replayed CSNP can result in the sending of unnecessary PSNPs on a
given link. A replayed CSNP or PSNP can result in unnecessary LSP
flooding on the link.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Extended Sequence Number TLV</span>
The Extended Sequence Number (ESN) TLV is composed of 1 octet for the
Type, 1 octet that specifies the number of bytes in the Value field,
and a 12-byte Value field. This TLV is defined only for IIH and SNP
PDUs.
Code - 11.
Length - total length of the value field, which is 12 bytes.
<span class="grey">Chunduri, et al. Standards Track [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
Value - 64-bit Extended Session Sequence Number (ESSN), which is
followed by a 32-bit, monotonically increasing, per-packet
sequence number.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+
| Type |
+-+-+-+-+-+-+-+-+
| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Extended Session Sequence Number (High-Order 32 Bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Extended Session Sequence Number (Low-Order 32 Bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Packet Sequence Number (32 Bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: Extended Sequence Number (ESN) TLV
The ESN TLV defined here is optional. Though this is an optional
TLV, it can be mandatory on a link when 'verify' mode is enabled as
specified in <a href="#section-5.1">Section 5.1</a>. The ESN TLV MAY be present only in IIH
PDUs and SNPs. A PDU with multiple ESN TLVs is invalid and MUST be
discarded on receipt.
The 64-bit ESSN MUST be nonzero and MUST contain a number that is
increased whenever it is changed due any situation, as specified in
<a href="#section-3.1">Section 3.1</a>. Encoding the 64-bit unsigned integer ESSN value is a
local matter, and implementations MAY use one of the alternatives
provided in <a href="#appendix-A">Appendix A</a>. Effectively, for each PDU that contains the
ESN TLV, the 96-bit unsigned integer value consisting of the 64-bit
ESSN and 32-bit Packet Sequence Number (PSN) -- where the ESSN is the
higher-order 64 bits -- MUST be greater than the most recently
received value in a PDU of the same type originated by the same IS.
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. Sequence Number Wrap</span>
If the 32-bit Packet Sequence Number in the ESN TLV wraps or the
router performs a cold restart, the 64-bit ESSN value MUST be set
higher than the previous value. IS-IS implementations MAY use the
guidelines provided in <a href="#appendix-A">Appendix A</a> for accomplishing this.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Mechanism and Packet Encoding</span>
The encoding of the ESN TLV in each applicable IS-IS PDU is detailed
below. Please refer to <a href="#section-5">Section 5</a> for appropriate operations on how
to interoperate with legacy node(s) that do not support the
<span class="grey">Chunduri, et al. Standards Track [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
extensions defined in this document. If the received PDU with the
ESN TLV is accepted, then the stored value for the corresponding
originator and PDU type MUST be updated with the latest value
received. Please note that level information is included in the PDU
type.
<span class="h3"><a class="selflink" id="section-4.1" href="#section-4.1">4.1</a>. IIHs</span>
ESN TLV information is maintained for each type of IIH PDU being sent
on a given circuit. The procedures for encoding, verification, and
sequence number wrapping are explained in <a href="#section-3">Section 3</a>.
<span class="h3"><a class="selflink" id="section-4.2" href="#section-4.2">4.2</a>. SNPs</span>
Separate CSNP/PSNP ESN TLV information is maintained per PDU type,
per originator, and per link. The procedures for encoding,
verification, and sequence number wrapping are explained in <a href="#section-3">Section</a>
<a href="#section-3">3</a>.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Backward Compatibility and Deployment</span>
The implementation and deployment of the ESN TLV can be done to
support backward compatibility and gradual deployment in the network
without requiring a flag day. This feature can also be deployed for
the links in a certain area of the network where the maximum security
mechanism is needed, or it can be deployed for the entire network.
The implementation SHOULD allow the configuration of ESN TLV features
on each IS-IS link level. The implementation SHOULD also allow
operators to control the configuration of the 'send' and/or 'verify'
feature of IS-IS PDUs for the links and for the node. In this
document, the 'send' mode is to include the ESN TLV in its own IS-IS
PDUs, and the 'verify' mode is to process the ESN TLV in the
receiving IS-IS PDUs from neighbors.
When an adversary is actively attacking, it is possible to have
inconsistent data views in the network, if there is a considerable
delay in enabling the 'verify' mode where nodes were configured to
the 'send' mode, e.g., from the first to the last node or all nodes
of a particular LAN segment. This happens primarily because replay
PDUs can potentially be accepted by the nodes where the 'verify' mode
is still not provisioned at the time of the attack. To minimize such
a window, it is recommended that provisioning of 'verify' SHOULD be
done in a timely fashion by the network operators.
<span class="grey">Chunduri, et al. Standards Track [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>. IIHs and SNPs</span>
On the link level, the ESN TLV involves the IIH PDUs and SNPs (both
CSNP and PSNP). The 'send' and 'verify' modes described above can be
set independently on each link and, in the case of a broadcast
network, independently on each level.
To introduce ESN support without disrupting operations, ISs on a
given interface are first configured to operate in 'send' mode. Once
all routers operating on an interface are operating in 'send' mode,
'verify' mode can be enabled on each IS. Once 'verify' mode is set
for an interface, all the IIH PDUs and SNPs being sent on that
interface MUST contain the ESN TLV. Any such PDU received without an
ESN TLV MUST be discarded when 'verify' mode is enabled. Similarly,
to safely disable ESN support on a link, 'verify' mode is disabled on
all ISs on the link. Once 'verify' mode is disabled on all routers
operating on an interface, 'send' mode can be disabled on each IS.
Please refer to <a href="#section-5">Section 5</a> for considerations on enabling or disabling
'verify' mode on all ISs on a link.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. IANA Considerations</span>
A new TLV codepoint, as defined in this document, has been assigned
by IANA from the "IS-IS TLV Codepoints" registry. It is referred to
as the Extended Sequence Number TLV and has the following attributes:
Value Name IIH LSP SNP Purge
----- --------------------- --- --- --- -----
11 ESN TLV y n y n
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Security Considerations</span>
This document describes a mechanism to mitigate the replay attack
threat as discussed in the Security Considerations sections of
[<a href="./rfc5304" title=""IS-IS Cryptographic Authentication"">RFC5304</a>] and [<a href="./rfc5310" title=""IS-IS Generic Cryptographic Authentication"">RFC5310</a>]. If an adversary interferes either by not
forwarding packets or by delaying messages as described in <a href="./rfc6862#section-3.3">Section</a>
<a href="./rfc6862#section-3.3">3.3 of [RFC6862]</a>, the mechanism specified in this document cannot
mitigate those threats. Also, some of the threats described in
Section 2.3 of [<a href="#ref-ISIS-ANALYSIS">ISIS-ANALYSIS</a>] are not addressable with the ESN TLV
as specified in this document. This document does not introduce any
new security concerns to IS-IS or any other specifications
referenced.
<span class="grey">Chunduri, et al. Standards Track [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. References</span>
<span class="h3"><a class="selflink" id="section-8.1" href="#section-8.1">8.1</a>. Normative References</span>
[<a id="ref-ISO10589">ISO10589</a>] International Organization for Standardization,
"Intermediate system to intermediate system intra-domain-
routing routine information exchange protocol for use in
conjunction with the protocol for providing the
connectionless-mode Network Service (ISO 8473)", ISO/IEC
10589:2002, Second Edition, Nov. 2002.
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>,
DOI 10.17487/RFC2119, March 1997,
<<a href="http://www.rfc-editor.org/info/rfc2119">http://www.rfc-editor.org/info/rfc2119</a>>.
[<a id="ref-RFC5905">RFC5905</a>] Mills, D., Martin, J., Ed., Burbank, J., and W. Kasch,
"Network Time Protocol Version 4: Protocol and Algorithms
Specification", <a href="./rfc5905">RFC 5905</a>, DOI 10.17487/RFC5905, June 2010,
<<a href="http://www.rfc-editor.org/info/rfc5905">http://www.rfc-editor.org/info/rfc5905</a>>.
<span class="h3"><a class="selflink" id="section-8.2" href="#section-8.2">8.2</a>. Informative References</span>
[<a id="ref-MRKMP">MRKMP</a>] Hartman, S., Zhang, D., and G. Lebovitz, "Multicast Router
Key Management Protocol (MaRK)", Work in Progress,
<a href="./draft-hartman-karp-mrkmp-05">draft-hartman-karp-mrkmp-05</a>, September 2012.
[<a id="ref-ISIS-ANALYSIS">ISIS-ANALYSIS</a>]
Chunduri, U., Tian, A., and W. Lu, "KARP IS-IS security
analysis", Work in Progress, <a href="./draft-ietf-karp-isis-analysis-07">draft-ietf-karp-isis-</a>
<a href="./draft-ietf-karp-isis-analysis-07">analysis-07</a>, July 2015.
[<a id="ref-GROUP-IKEv2">GROUP-IKEv2</a>] Rowles, S., Yeung, A., Ed., Tran, P., and Y. Nir,
"Group Key Management using IKEv2", Work in Progress,
<a href="./draft-yeung-g-ikev2-08">draft-yeung-g-ikev2-08</a>, October 2014.
[<a id="ref-RFC5304">RFC5304</a>] Li, T. and R. Atkinson, "IS-IS Cryptographic
Authentication", <a href="./rfc5304">RFC 5304</a>, DOI 10.17487/RFC5304, October
2008, <<a href="http://www.rfc-editor.org/info/rfc5304">http://www.rfc-editor.org/info/rfc5304</a>>.
[<a id="ref-RFC5310">RFC5310</a>] Bhatia, M., Manral, V., Li, T., Atkinson, R., White, R.,
and M. Fanto, "IS-IS Generic Cryptographic
Authentication", <a href="./rfc5310">RFC 5310</a>, DOI 10.17487/RFC5310, February
2009, <<a href="http://www.rfc-editor.org/info/rfc5310">http://www.rfc-editor.org/info/rfc5310</a>>.
<span class="grey">Chunduri, et al. Standards Track [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
[<a id="ref-RFC6862">RFC6862</a>] Lebovitz, G., Bhatia, M., and B. Weis, "Keying and
Authentication for Routing Protocols (KARP) Overview,
Threats, and Requirements", <a href="./rfc6862">RFC 6862</a>,
DOI 10.17487/RFC6862, March 2013,
<<a href="http://www.rfc-editor.org/info/rfc6862">http://www.rfc-editor.org/info/rfc6862</a>>.
[<a id="ref-RFC7474">RFC7474</a>] Bhatia, M., Hartman, S., Zhang, D., and A. Lindem, Ed.,
"Security Extension for OSPFv2 When Using Manual Key
Management", <a href="./rfc7474">RFC 7474</a>, DOI 10.17487/RFC7474, April 2015,
<<a href="http://www.rfc-editor.org/info/rfc7474">http://www.rfc-editor.org/info/rfc7474</a>>.
<span class="grey">Chunduri, et al. Standards Track [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
<span class="h2"><a class="selflink" id="appendix-A" href="#appendix-A">Appendix A</a>. ESSN Encoding Mechanisms</span>
IS-IS nodes implementing this specification SHOULD use available
mechanisms to preserve the 64-bit Extended Session Sequence Number's
strictly increasing property, whenever it is changed for the deployed
life of the IS-IS node (including cold restarts).
This appendix provides guidelines for maintaining the strictly
increasing property of the 64-bit ESSN in the ESN TLV, and
implementations can resort to any similar method as long as this
property is maintained.
<span class="h3"><a class="selflink" id="appendix-A.1" href="#appendix-A.1">A.1</a>. Using Timestamps</span>
One mechanism for accomplishing this is by encoding the 64-bit ESSN
as the system time represented by a 64-bit unsigned integer value.
This MAY be similar to the system timestamp encoding for the NTP long
format as defined in <a href="./rfc5905#appendix-A.4">Appendix A.4 of [RFC5905]</a>. The new current time
MAY be used when the IS-IS node loses its sequence number state
including when the Packet Sequence Number wraps.
Implementations MUST make sure while encoding the 64-bit ESN value
with the current system time that it does not default to any previous
value or some default node time of the system, especially after cold
restarts or any other similar events. In general, system time must
be preserved across cold restarts in order for this mechanism to be
feasible. One example of such implementation is to use a battery
backed real-time clock (RTC).
<span class="h3"><a class="selflink" id="appendix-A.2" href="#appendix-A.2">A.2</a>. Using Non-volatile Storage</span>
One other mechanism for accomplishing this is similar to the one
specified in [<a href="./rfc7474" title=""Security Extension for OSPFv2 When Using Manual Key Management"">RFC7474</a>] -- use the 64-bit ESSN as a wrap/boot count
stored in non-volatile storage. This value is incremented anytime
the IS-IS node loses its sequence number state, including when the
Packet Sequence Number wraps.
There is a drawback to this approach, which is described as follows
in <a href="./rfc7474#section-8">Section 8 of [RFC7474]</a>. It requires the IS-IS implementation to
be able to save its boot count in non-volatile storage. If the non-
volatile storage is ever repaired or router hardware is upgraded such
that the contents are lost, keys MUST be changed to prevent replay
attacks.
<span class="grey">Chunduri, et al. Standards Track [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
<span class="h2"><a class="selflink" id="appendix-B" href="#appendix-B">Appendix B</a>. Operational/Implementation Considerations</span>
Since the ESN is maintained per PDU type, per originator, and per
link, this scheme can be useful for monitoring the health of the
IS-IS adjacency. A Packet Sequence Number skip that occurs upon
receiving an IIH can be recorded by the neighbors and can be used
later to correlate adjacency state changes over the interface. For
instance, in multi-access media, completely different issues on the
network may be indicated when all neighbors record skips from the
same IIH sender versus when only one neighbor records skips. For
operational issues, effective usage of the TLV defined in this
document MAY also need more system information before making concrete
conclusions; defining all that information is beyond the scope of
this document.
Acknowledgements
As some sort of sequence number mechanism to thwart protocol replays
is a old concept, the authors of this document do not make any claims
on the originality of the overall protection idea described. The
authors are thankful for the review and the valuable feedback
provided by Acee Lindem and Joel Halpern. Thanks to Alia Atlas,
Chris Hopps, Nevil Brownlee, and Adam W. Montville for their reviews
and suggestions during IESG directorate review. The authors also
thank Christer Holmberg, Ben Campbell, Barry Leiba, Stephen Farrell,
and Alvaro Retana for their reviews of this document.
Contributors
The authors would like to thank Les Ginsberg for his significant
contribution in detailed reviews and suggestions.
<span class="grey">Chunduri, et al. Standards Track [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc7602">RFC 7602</a> IS-IS Extended Sequence Number TLV July 2015</span>
Authors' Addresses
Uma Chunduri
Ericsson Inc.
300 Holger Way,
San Jose, California 95134
United States
Phone: 408 750-5678
Email: uma.chunduri@ericsson.com
Wenhu Lu
Ericsson Inc.
300 Holger Way,
San Jose, California 95134
United States
Email: wenhu.lu@ericsson.com
Albert Tian
Ericsson Inc.
300 Holger Way,
San Jose, California 95134
United States
Phone: 408 750-5210
Email: albert.tian@ericsson.com
Naiming Shen
Cisco Systems, Inc.
225 West Tasman Drive,
San Jose, California 95134
United States
Email: naiming@cisco.com
Chunduri, et al. Standards Track [Page 12]
</pre>
|
