[149257] in North American Network Operators' Group
Re: MD5 considered harmful
daemon@ATHENA.MIT.EDU (Lee)
Tue Jan 31 14:57:19 2012
In-Reply-To: <4F282B4A.7000603@foobar.org>
Date: Tue, 31 Jan 2012 14:56:52 -0500
From: Lee <ler762@gmail.com>
To: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 1/31/12, Nick Hilliard <nick@foobar.org> wrote:
> On 31/01/2012 16:40, David Barak wrote:
>> Because downtime is a security issue too, and MD5 is more likely to
>> contribute to downtime (either via lost password, crypto load on CPU, or
>> other) than the problem it purports to fix. The goal of a network
>> engineer is to move packets from A -> B. The goal of a security
>> engineer is to keep that from happening. A business needs to weigh the
>> cost and benefit of any given approach, and MD5 BGP auth does not come
>> out well in the of situations.
>
> cpu load is negligible and is done in hardware on several platforms. Lost
> passwords can occur but if you have properly stored configuration backups,
> they shouldn't be a major problem. Also, they can be trivially decrypted
> from C/J configuration files.
>
> From my point of view, MD5 passwords serve two purposes:
.. snip ..
>
> 2. they can be used to convince security auditors that the network is
> secure and that they can now sod off and stop harassing me, kthxbai
+1
It isn't worth the time or effort trying to get an exception to their
'best practice'.
Lee
