Routing protocols and their weaknesses

In order to communicate on the Internet at all, we must find a way to each other. I am not talking here about the path that ensures the perception of thoughts by the other party, although this is also a demanding discipline. I mean the path that ensures the delivery of packets or messages. This is based on routing algorithms that map the Internet. Or at least its immediate surroundings. Thanks to this, it is the routing protocols that govern the Internet. But their protection is currently dismal.

Authentication and integrity protection

However, the above overview describes the principles, not the protection of the trustworthiness of the transmitted data. Therefore, the following table provides an overview of the authentication mechanisms that are used to verify the sender of this information.

This table shows that most protocols for routing communication use the MD5 algorithm (broken in 2005), or have no protection at all. The use of HMAC-SHA, TCP-AO or IPSec is relatively rare, so it is necessary to ensure the deployment of at least basic control mechanisms at the firewall level. It is even worse with integrity control.

What authentication algorithms can we actually use?

The following paragraphs discuss individual methods of verifying authentication mechanisms and possible comments on these technologies.

No authentication

Relying on the trustworthiness of the counterparty without any evidence. No further comments are possible.

• No protection

Plaintext

The plaintext option is the simplest possible way of protection. The password is part of the transmission and both sides must have the same password. Unfortunately, due to the transmission of the password in an open form, the password is available to any user with the ability to monitor the traffic.

• The password can be obtained by any user with the ability to monitor the network

Password

The password method is usually (but not always) different from plaintext. Password control can take various forms and some algorithms within the password method also offer the exchange of plaintext information. In other cases, a simple form of authentication is used, where a hash of the packet content is created, supplemented with a password. A typical example is OSPFv2. In the case of authentication using the password option, the biggest problem is probably trust in outdated and broken functions. In the case of MD5, it is relatively easy to find collisions that allow falsification of routing tables. At the same time, they only provide the illusion of security. The possible use of HMAC-MD5 will make the possibility of collision detection more difficult, but will not completely eliminate it.

• Implementation specifies the level of security (plaintext, password hash, password-keyed hash)
• It usually used MD5
• Possibility of using collision detection to attack routing tables

MD5

Probably the best-known and oldest method of authentication is the use of the MD5 function. Unfortunately, this is the most complex description, which varies by protocol. The original, early forms of authentication using password hashing have been overcome. This was followed by the use of the password as a key for integrity checking, and before MD5 was broken, the use of HMAC. When mentioning authentication using MD5, it is difficult to determine which method was used. Due to these inconsistencies, but mainly for security reasons, this algorithm should no longer be used at all.
Authenticator=MD5(Password)
MAC=MD5(Password||Content)

• MD5, broken 2005
• Possibility to use collision detection to attack routing tables
• MAC for integrity checking does not have to be used, usually only hash

TCP-MD5, RFC 2385

MD5 was a valid protocol at the time of its creation, and the effort to standardize its use corresponds to this. The algorithm does not transmit the password, but the password is used as part of an integrity check. Although the recipient does not know whether the password is incorrect or the data content has been compromised, the information is considered corrupted and must not be used.

MAC Algorithms:
MD5 hashes specific content and password. It does not use HMAC access, but a simple MAC. The key is appended to the end of the text. This approach is considered outdated and risky.
Authenticator=MD5(Source IP||Destination IP|| zero padded protocol number|| segment length|| TCP header|| TCP segment data|| password)

• MD5, broken 2005
• Possibility of using collision detection to attack routing tables

TCP Authentication Option (TCP-AO), RFC 5926

The breaking of the MD5 function and the development of other hash functions, together with the standardization of AES, led to the use of significantly more secure methods. An example is the use of functions based on SHA2, or the use of AES. Unfortunately, for AES, there is a limitation given by the transition to PQC, which requires at least a 192b encryption key, while this algorithm only accepts 128b encryption keys.

Baseline AlgorithmsKey Derivation Functions (KDFs):

• KDF_HMAC_SHA1 (deprecated)
• KDF_AES_128_CMAC (until 2030)

• HMAC-SHA-1-96 (deprecated and limited)
• AES-128-CMAC-96 (deprecated and limited)

• HMAC-SHA-1 (deprecated)
• HMAC-SHA-256 (until 2030)
• HMAC-SHA-384 (current)
• HMAC-SHA-512 (current)
• AES-128-CMAC / AES-CMAC-128 (until 2030)

IPSec authentication

Authentication using IPSec mainly uses the use of the AH header (Authentication Header). In this case, the ability of the protocol to create a checksum of the message is used, where the key for this checksum is the password itself. That is, there is no encryption, only the ability of IPSec to delay transmission is used. Alternatively, it is possible to encrypt the entire content in order to ensure not only integrity, but also confidentiality. The advantage in this case is the use of IPSec, which provides protection and at the same time separates the individual layers from each other.

Comparison of OSPFv2 and OSPFv3

OSPF protocol version 2 came with the concept of choosing the protection of routing information transmission. The following possible settings are part of the protocol:

• Auth Type 0 – None
• Auth Type 1 – Simple Password
• Auth Type 2 – Cryptographic Authentication (originally MD5)

The OSPFv3 routing protocol uses a similar protection control principle as OSPFv2, but uses the IPSec protocol for these purposes.

BGP protocol and rPKI

A specific feature of the BGP protocol is the possibility of authentication thanks to rPKI, which is often explained as authentication based on PKI. Unfortunately, this is not true. So what is the relationship between rPKI and mutual authentication?

The own rPKI (Resource PKI, RFC 6810) is used for authentication of routing information. More precisely, it allows IP address owners to publicly declare which autonomous system (AS) is authorized to advertise their network range to the Internet using the routing protocol. The declaration of these permissions is completely different from the authentication of counterparts and has a different purpose. The goal of rPKI is to provide verification of the authorization to publish this information. The actual publication is then provided by the AS (Autonomous System) within which the specified range is used.

The own authentication of counterparts is then provided by other protocols. It occurs both at the very beginning and throughout the duration of the BGP session. The role of TCP-MD5 or TCP-AO authentication. The verification occurs when the TCP handshake (SYN, SYN-ACK, ACK) is established and then for each sent TCP segment. If a router receives a BGP packet whose MD5/AO signature does not match, the TCP layer immediately discards it and the BGP process does not know about it at all. The fact that you are talking to the correct, authorized neighbor (peer) is authenticated here.

In short, while rPKI allows you to verify that the advertised route on the Internet belongs to the correct owner, TCP-MD5 or TCP-AO ensures that the messages themselves with this routing information, transmitted in BGP, have not been forged or modified by anyone along the way. Unfortunately, in the case of TCP-MD5, this evidence is weak and the MD5 algorithm should no longer be used.

Conclusion

Routing algorithms currently do not use current protection methods. A large number of algorithms, operating without protection or with protection using plaintext passwords or MD5, do not contribute to the high trustworthiness of these basic services. Ensuring confidentiality, integrity and authenticity of data is usually weak here, which creates a lot of room for attackers. A partial solution is to consistently assign permissions using ACLs so that they at least partially limit where the router can receive information from. It is also advisable to switch to modern protocols where this is at least somewhat possible. Unfortunately, in addition to security problems, routing algorithms also have their own technological problems. The mutual influence of network architecture and protocol options can limit the options for choosing when designing the network structure.

Autor článku:

Jan Dušátko

Jan Dušátko has been working with computers and computer security for almost a quarter of a century. In the field of cryptography, he has cooperated with leading experts such as Vlastimil Klíma or Tomáš Rosa. Currently he works as a security consultant, his main focus is on topics related to cryptography, security, e-mail communication and Linux systems.