key change for TCP-MD5

Tue Jun 20 19:53:51 UTC 2006

On Tue, 20 Jun 2006 21:16:05 +0200, Iljitsch van Beijnum said:

> What if we agree to change the key on our BGP session, I add the new  
> key on my side and start sending packets using the new key, while you  
> don't have the new key in your configuration yet?

How is that *any* different than you sending an e-mail saying "Here's the new
key we'll put into production at 3:17:04.97 GMT, hope you're NTP-synced" and
not waiting for an ACK from the other end before proceeding?

I'd encourage my competitors to design their procedures that way, but it only
works for competitors that you aren't either peering or directly transiting
with.  Otherwise, you're merely handing them a loaded gun to point at your
feet...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20060620/7bf2dd21/attachment.sig>