Intermediate System to Intermediate System (IS-IS) Cryptographic Authentication
RFC 3567

Document Type RFC - Informational (July 2003; No errata)
Obsoleted by RFC 5304
Authors Randall Atkinson  , Tony Li 
Last updated 2015-10-14
Stream Internet Engineering Task Force (IETF)
Formats plain text html pdf htmlized (tools) htmlized bibtex
Stream WG state (None)
Document shepherd No shepherd assigned
This information refers to IESG processing after the RFC was initially published:
IESG IESG state RFC 3567 (Informational)
Action Holders
Consensus Boilerplate Unknown
Telechat date
Responsible AD Ross Callon
Send notices to (None)
Network Working Group                                              T. Li
Request for Comments: 3567                              Procket Networks
Category: Informational                                      R. Atkinson
                                                        Extreme Networks
                                                               July 2003

          Intermediate System to Intermediate System (IS-IS)
                      Cryptographic Authentication

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.


   This document describes the authentication of Intermediate System to
   Intermediate System (IS-IS) Protocol Data Units (PDUs) using the
   Hashed Message Authentication Codes - Message Digest 5 (HMAC-MD5)
   algorithm as found in RFC 2104.  IS-IS is specified in International
   Standards Organization (ISO) 10589, with extensions to support
   Internet Protocol version 4 (IPv4) described in RFC 1195.  The base
   specification includes an authentication mechanism that allows for
   multiple authentication algorithms.  The base specification only
   specifies the algorithm for cleartext passwords.

   This document proposes an extension to that specification that allows
   the use of the HMAC-MD5 authentication algorithm to be used in
   conjunction with the existing authentication mechanisms.

1. Introduction

   The IS-IS protocol, as specified in ISO 10589 [1], provides for the
   authentication of Link State PDUs (LSPs) through the inclusion of
   authentication information as part of the LSP.  This authentication
   information is encoded as a Type-Length-Value (TLV) tuple.  The use
   of IS-IS for IPv4 networks is described in [3].

   The type of the TLV is specified as 10.  The length of the TLV is
   variable.  The value of the TLV depends on the authentication
   algorithm and related secrets being used.  The first octet of the
   value is used to specify the authentication type.  Type 0 is

Li & Atkinson                Informational                      [Page 1]
RFC 3567           IS-IS Cryptographic Authentication          July 2003

   reserved, type 1 indicates a cleartext password, and type 255 is used
   for routing domain private authentication methods.  The remainder of
   the TLV value is known as the Authentication Value.

   This document extends the above situation by allocating a new
   authentication type for HMAC-MD5 and specifying the algorithms for
   the computation of the Authentication Value.  This document also
   describes modifications to the base protocol to ensure that the
   authentication mechanisms described in this document are effective.

   This document is a publication of the IS-IS Working Group within the
   IETF, and is a contribution to ISO IEC JTC1/SC6, for eventual
   inclusion with ISO 10589.

2. Authentication Procedures

   The authentication type used for HMAC-MD5 is 54 (0x36).  The length
   of the Authentication Value for HMAC-MD5 is 16, and the length field
   in the TLV is 17.

   The HMAC-MD5 algorithm requires a key K and text T as input [2].  The
   key K is the password for the PDU type, as specified in ISO 10589.
   The text T is the IS-IS PDU to be authenticated with the
   Authentication Value field inside of the Authentication Information
   TLV set to zero.  Note that the Authentication Type is set to 54 and
   the length of the TLV is set to 17 before authentication is computed.
   When LSPs are authenticated, the Checksum and Remaining Lifetime
   fields are set to zero (0) before authentication is computed.  The
   result of the algorithm is placed in the Authentication Value field.

   When calculating the HMAC-MD5 result for Sequence Number PDUs, Level
   1 Sequence Number PDUs SHALL use the Area Authentication string as in
   Level 1 Link State PDUs.  Level 2 Sequence Number PDUs shall use the
   domain authentication string as in Level 2 Link State PDUs.  IS-IS
   HELLO PDUs SHALL use the Link Level Authentication String, which MAY
   be different from that of Link State PDUs.  The HMAC-MD5 result for
   the IS-IS HELLO PDUs SHALL be calculated after the Packet is padded
   to the MTU size, if padding is not disabled.  Implementations that
   support the optional checksum for the Sequence Number PDUs and IS-IS
   HELLO PDUs MUST NOT include the Checksum TLV.

   To authenticate an incoming PDU, a system should save the values of
   the Authentication Value field, the Checksum and the Remaining
   Lifetime field, set these fields to zero, compute authentication, and
   then restore the values of these fields.

Li & Atkinson                Informational                      [Page 2]
RFC 3567           IS-IS Cryptographic Authentication          July 2003

   An implementation that implements HMAC-MD5 authentication and
Show full document text