Routing Protocol Authentication
Network administrators must be aware that routers are at risk from attack just as much as end-user devices. Anyone with a packet sniffer, such as Wireshark, can read information propagating between routers. In general, routing systems can be attacked through the disruption of peer devices or the falsification of routing information.
Disruption of peers is the less critical of the two attacks because routing protocols heal themselves, making the disruption last only slightly longer than the attack itself.
The falsification of routing information is a more subtle class of attack that targets the information carried within the routing protocol. The consequences of falsifying routing information are as follows:
- Redirect traffic to create routing loops
- Redirect traffic to monitor on an insecure line
- Redirect traffic to discard it
A method to protect routing information on the network is to authenticate routing protocol packets using the Message Digest 5 (MD5) algorithm. MD5 allows the routers to compare signatures that should all be the same, confirming that it is from a credible source.
The three components of such a system include:
- Encryption algorithm, which is generally public knowledge
- Key used in the encryption algorithm, which is a secret shared by the routers authenticating their packets
- Contents of the packet itself
In the figure, click the Play button to view an animation of how each router authenticates the routing information. Generally, the originator of the routing information produces a signature using the key and routing data it is about to send as inputs to the encryption algorithm. The router receiving the routing data can then repeat the process using the same key and the same routing data it has received. If the signature the receiver computes is the same as the signature, the sender computes the update is authenticated and considered reliable.
Routing protocols such as RIPv2, EIGRP, OSPF, IS-IS, and BGP all support various forms of MD5 authentication.