Describes how TCP MD5 and TCP-AO secure PCEP sessions and explains their validation behavior, replay protection, restrictions, and configuration.
The PCEP session authentication is a security mechanism that
-
establishes a secure and trusted communication channel between a PCC and a PCE
-
ensures that only authorized devices can participate in PCEP sessions, and
-
protects against unauthorized access and data tampering.
Methods of PCEP authentication
PCEP authentication can be achieved using one of two primary methods:
-
TCP Message Digest 5 (MD5) Authentication: This method uses a clear text or encrypted password for authentication. Segments lacking a Message Authentication Code (MAC) that matches the configured password are rejected.
-
TCP Authentication Option (TCP-AO): TCP-AO uses Message Authentication Codes (MACs), which provides these benefits:
-
Protection against replays for long-lived TCP connections
-
More details on the security association with TCP connections than TCP MD5
-
A larger set of MACs with minimal system and operational changes.
TCP-AO is compatible with Master Key Tuple (MKT) configuration, protecting connections by deriving traffic keys from the MKT and coordinating changes between endpoints. Segments lacking a MAC that matches the configured key chain are rejected.
-
TCP-AO and TCP MD5 are never permitted to be used simultaneously. TCP-AO supports IPv6, and is fully compatible with the proposed requirements for the replacement of TCP MD5.