Authentication and Confidentiality in Protocol Independent Multicast Sparse Mode (PIM-SM) Link-Local Messages
updates
- rfc-4601 — Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised)
Extracted elements (28)
Anti-replay is not recommended with manual keying because link-local messages have TTL=1 and never propagate beyond one hop, limiting the replay attack surface. The per-sender SA lookup (using interface ID + sender address) eliminates the multi-sender SA problem that would otherwise prevent anti-replay.
ESP is made mandatory and AH is specified as optional, in accordance with RFC 4301. This aligns the PIM-SM specification with the newer AH (RFC 4302) and ESP (RFC 4303) specifications. The original RFC 4601 security considerations were based primarily on AH.
Link-local communication is treated as Source-Specific Multicast (SSM) even though ALL_PIM_ROUTERS is an Any-Source Multicast address, because the sender address combined with the interface ID tag makes each communicating pair unique. This allows anti-replay and per-sender SA lookup despite the shared multicast destination.
The Extended Sequence Number (ESN) with a 64-bit counter is recommended for manual keying because a PIM router can never exhaust the 2^64-1 packet sequence space in its lifetime, making sequence number rollover a non-issue and allowing manual keys to remain viable without forced rekeying due to counter exhaustion.
The two-SA method (fixed SAo/SAi pair with identical parameters shared across all routers) is recommended for manual keying because it keeps SA count constant at two regardless of network size, simplifying administration. The unique-SA-per-peer method is more scalable but practically requires automated key management.
When the speaking router is used as the local Group Controller/Key Server (GC/KS), no duplication for reliability is needed: if the key server is down, the speaking router is almost certainly also down. This makes co-location of the key server with the speaking router a practical and reliable design choice.
This document updates RFC 4601. RFC 4601 mandated IPsec authentication based primarily on AH; this document redefines the security requirements to make ESP mandatory and AH optional, and introduces the structured manual rekeying procedure not present in RFC 4601.
A router SHOULD NOT dynamically detect new neighbors as the result of receiving an unauthenticated PIM-SM link-local message or an IPsec packet that fails SAD lookup. An automated key management protocol SHOULD provide a means of notifying a router of new, legitimate neighbors.
All implementations conforming to this specification MUST support SA in transport mode to provide required IPsec security to PIM-SM link-local messages. Tunnel mode MAY also be supported, but if used, both destination and source address preservation MUST be employed.
All implementations MUST support manual configuration of the Security Associations used to authenticate PIM-SM link-local messages. This does not preclude use of negotiation protocols such as GDOI or GSAKMP.
All routers on a link MUST use the same value for KeyRolloverInterval and MUST initiate the key rollover process within this time period. All routers MUST complete step 1 (add new inbound SA) before any begin step 2, and all MUST complete step 2 before any begin step 3.
During manual rekeying, the SA replacement operation (step 2: replacing original outbound SA with new SPI and key values) MUST be atomic with respect to sending PIM-SM packets on the link, so that no PIM-SM packets are sent without authentication/encryption.
Each manually configured SAD entry must have a unique SPI assigned by the Administrator to avoid conflicts. The receiving router MUST use SPI plus destination address plus sender address in the SA lookup, and the interface ID tag, SPI, and sender address MUST all be used in the SA lookup process.
If automatic keying is implemented, the implementation MUST support the Group Security Policy Database (GSPD) described in RFC 5374, including multiple GSPDs with interface-based GSPD selection and source/destination/protocol/direction selectors.
Implementations MUST support authentication for PIM-SM link-local messages, MUST support HMAC-SHA1, MUST support ESP, and MAY support AH. ESP in transport mode provides authentication only to the PIM-SM protocol packets excluding the IP header; AH also covers selected IP header fields.
Implementations MUST support ESP-NULL and MUST NOT allow the user to choose a stream cipher or block mode cipher in counter mode for use with manual keys. IP encapsulation of ESP packets MUST be supported; UDP encapsulation SHOULD NOT be used.
Implementations SHOULD support confidentiality for PIM-SM. If confidentiality is supported, AES-CBC with a 128-bit key MUST be supported, and ESP MUST be used. An implementation MUST NOT generate the combination of NON-NULL Encryption and NULL Authentication.
PIM-SM link-local packets not protected with AH or ESP, or that fail authentication checks, MUST be silently discarded by IPsec. An implementation may maintain a counter of such discarded packets.
The anti-replay mechanism is RECOMMENDED for activation only when SAs are assigned using automated key management. If manual key management is used, anti-replay SHOULD NOT be activated. If a router restarts, the sequence-number counter MUST be correctly maintained across reboots until the key is replaced.
The encryption and authentication keys SHOULD be changed at least every 90 days to limit key exposure.
The IPsec implementation MUST support multiple SPDs with an SPD selection function that selects a specific SPD based on interface. It MUST be able to use source address, destination address, protocol, and direction as selectors, and MUST tag inbound packets with the interface ID on which they arrived.
The two-SA method (one SA for outbound SAo, one for inbound SAi, with identical parameters shared among all routers in an administrative region) MUST be supported by every implementation. This document RECOMMENDS this method for manual key configuration.
When an Extended Sequence Number (ESN) is used with a manually keyed SA, the ESN value MUST be saved over a reboot, along with an indication of which sequence numbers have been used. When manual configuration is used, ESN SHOULD be deployed as the sequence number for the sliding window protocol.
For automatic keying, the GSPD is configured with 'sender only' directional entries that trigger the group key management protocol for a registration exchange, which sets up the outbound SAD entry; the exchange also installs 'receiver only' GSPD entries for each legitimate peer router.
PIM-SM link-local messages (Hello, Join/Prune, and Assert) use IP protocol number 103 with TTL=1, a link-local source address, and ALL_PIM_ROUTERS as the destination (224.0.0.13 for IPv4, ff02::d for IPv6). A forged link-local message sent to ALL_PIM_ROUTERS can disrupt distribution tree construction.
Manual key limitations include: inability to provide replay protection (leaving routers vulnerable to packet replay attacks); long key lifetimes that give attackers time to discover keys; and the risk of administrators configuring weak keys (known weak keys exist for DES/3DES).
Using the same key on all PIM routers connected to a link leaves them all vulnerable to impersonation attacks if any single router is compromised, malfunctioning, or misconfigured. This is an inherent limitation of the shared-key approach used in the two-SA method.
Manual rekeying follows a three-step atomic procedure: (1) add new inbound SA with new SPI and key on all routers; (2) atomically replace outbound SA with new SPI/key on all routers (no gaps in protection); (3) remove original inbound SA on all routers. Each step must complete across all routers before the next begins, controlled by KeyRolloverInterval.