OSPF Authentication

What OSPF authentication does

OSPF authentication is the mechanism that checks whether the router on the other side of a link is the one you expect. Without it, OSPF does not verify the source of a Hello it receives. Anything attached to the same segment that sends Hellos will form an adjacency and start injecting LSAs.

Authentication lives entirely inside the OSPF header, in two fields: AuType (the method) and Authentication (8 bytes). The header layout is covered in OSPF Packet Types and Header Format, so this article concentrates on how to configure it and how to operate the keys.

Method	AuType	What it does
None	`0`	No verification. The default state
Plain text	`1`	Puts the password in the packet as-is. Anyone who captures it can read it
Cryptographic	`2`	Appends a digest computed from a key. The key itself never travels

Authentication is a per-link setting. Configure it on one side only and the other side’s Hellos fail verification and are discarded, so the adjacency drops when the Dead interval expires. Conversely, one router can use different settings, or different keys, on each of its links.

Two places to configure it

IOS XR lets you configure authentication per area or per interface.

Where	Configuration block	Scope
Per area	under `router ospf <process>` → `area <ID>`	Every interface in that area
Per interface	under `area <ID>` → `interface <IF>`	That interface only

When both are present, the interface-level setting wins. That lets you enable authentication across an area and override the exceptions link by link.

Keys live in a keychain

Keys for cryptographic authentication are not written into the OSPF configuration. They go into a separate container called a keychain, and the interface refers to it by name.

Structure of a keychain
key chain <name>
 key <key ID>
  cryptographic-algorithm <algorithm>
  key-string clear <key string>
  send-lifetime   <start> <end>   <- when this key may be used for sending
  accept-lifetime <start> <end>   <- when this key is accepted on receive

The important part is that each key ID carries its own send and accept periods. Put several keys in one keychain, switch the accept side first and the send side second, and you can replace a key without dropping the adjacency.

The key ID travels in the packet’s Key ID field, and the receiver uses that number to pick the key. The digest length is determined by the algorithm: 32 bytes for HMAC-SHA-256 as defined in RFC 5709, 16 bytes for MD5. That length appears directly in the packet as Auth Crypt Data Length.

Test setup

R1 - R2 - R3 in a line, every link in area 0. Authentication is configured only on R1 - R2; R2 - R3 is left without it. R2’s show output therefore lists an authenticated interface and an unauthenticated one side by side, which shows directly that authentication is a per-link setting.

Item	Value
Link with authentication	R1 - R2 (10.1.2.0/24)
Link without authentication	R2 - R3 (10.2.3.0/24)
Router IDs	`1.1.1.1` on R1, `2.2.2.2` on R2, `3.3.3.3` on R3 (all set explicitly)
Capture	R1 - R2 (filter `ip proto 89`)
Software	XRd 26.1.1

The test runs in seven STEPs.

STEP	Change	What to look for
0	No authentication	No authentication lines in the output
1	Configure plain text	The password is readable in the capture. One-sided configuration drops the adjacency
2	Switch to MD5 (keychain)	`Auth Crypt Data Length` is 16. R2’s other link stays unauthenticated
3	Switch to HMAC-SHA-256	`Auth Crypt Data Length` changes to 32
4	Add a key and roll over	`Key ID` goes from 1 to 2. The adjacency stays up
5	Add area-level authentication	The interface-level setting wins
6	Remove authentication	Back to the unauthenticated state (final state)

STEP 0: no authentication

On an interface without authentication, show ospf interface prints no authentication lines at all. The place to look is between Suppress hello and Multi-area interface Count.

R1 Gi0/0/0/0 (no authentication, STEP 0)
RP/0/RP0/CPU0:R1#show ospf interface GigabitEthernet0/0/0/0
Fri Sep 11 05:45:20.485 UTC

GigabitEthernet0/0/0/0 is up, line protocol is up 
  Internet Address 10.1.2.1/24, Area 0, SID 0, Strict-SPF SID 0
  Label stack Primary label 0 Backup label 0 SRTE label 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1, MTU 1500, MaxPktSz 1500
  Forward reference No, Unnumbered no,  Bandwidth 1000000 
  RIB LC sync Yes
  Designated Router (ID) 1.1.1.1, Interface address 10.1.2.1
  Backup Designated router (ID) 2.2.2.2, Interface address 10.1.2.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:04:035
  Index 1/1, flood queue length 0
  Next 0(0)/0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never

STEP 1: configure plain text authentication

Under the interface, authentication with no keyword selects plain text, and authentication-key sets the password.

Configuration applied in STEP 1 (R1 only at first)
(R1)
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   authentication
   authentication-key ospfauth

Configuring only R1 drops the R1 - R2 adjacency. R2 keeps sending unauthenticated Hellos and R1 discards them as failing verification. R1’s syslog shows the adjacency going down 32 seconds after the commit. It is recorded as dead timer expired, not as an authentication error.

R1 syslog (just after configuring one side, STEP 1)
RP/0/RP0/CPU0:Sep 11 05:46:42.207 UTC: config[67620]: %MGBL-CONFIG-6-DB_COMMIT : Configuration committed by user 'cisco'. Use 'show configuration commit changes 1000000001' to view the changes. 
RP/0/RP0/CPU0:Sep 11 05:46:42.444 UTC: config[67620]: %MGBL-SYS-5-CONFIG_I : Configured from console by cisco 
RP/0/RP0/CPU0:Sep 11 05:46:44.236 UTC: config[67639]: %MGBL-CONFIG-6-DB_COMMIT : Configuration committed by user 'cisco'. Use 'show configuration commit changes 1000000002' to view the changes. 
RP/0/RP0/CPU0:Sep 11 05:46:44.418 UTC: config[67639]: %MGBL-SYS-5-CONFIG_I : Configured from console by cisco 
RP/0/RP0/CPU0:Sep 11 05:47:16.873 UTC: ospf[1035]: %ROUTING-OSPF-5-ADJCHG : Process 1, Nbr 2.2.2.2 on GigabitEthernet0/0/0/0 in area 0 from FULL to DOWN, Neighbor Down: dead timer expired, vrf default vrfid 0x60000000 

That is why the mistake is hard to spot. When an adjacency drops, compare the authentication configuration at both ends.

Applying the same configuration to R2 brings the adjacency back, and show ospf interface now shows Clear text authentication enabled.

R1 Gi0/0/0/0 (plain text, STEP 1)
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Clear text authentication enabled
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never

The problem is that the password goes into the packet as-is. No.33 in the capture shows the configured ospfauth in the clear.

No.33 Hello (plain text; the password is visible)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0xce8e [correct]
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Simple password (1)
        Auth Data (Simple): ospfauth
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 10.1.2.1
        Backup Designated Router: 10.1.2.2
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x7fc2
        LLS Data Length: 32 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000004
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8

Download the pcap of the packet in the tshark output above (No.33 Hello)

Plain text authentication is worthless where the path can be sniffed. Its only real use is preventing an unintended adjacency caused by a configuration mistake.

STEP 2: switch to MD5 (keychain)

Moving to cryptographic authentication. Define a keychain first, then refer to it by name from the interface.

Configuration applied in STEP 2
(apply to both R1 and R2)
key chain KC-OSPF
 key 1
  accept-lifetime 00:00:00 january 01 2020 infinite
  send-lifetime 00:00:00 january 01 2020 infinite
  cryptographic-algorithm HMAC-MD5
  key-string clear ospfkey1
!
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   no authentication
   no authentication-key
   authentication keychain KC-OSPF

The output changes to Keychain-based authentication enabled, followed by the keychain name, the key ID in use and the algorithm. The trailing 16 in HMAC_MD5_16 is the digest length in bytes.

R1 Gi0/0/0/0 (MD5, STEP 2)
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Keychain-based authentication enabled
    Keychain name KC-OSPF
    Key id used is 1
    Cryptographic algorithm HMAC_MD5_16
  Multi-area interface Count is 0

The key string itself never enters a packet. show key chain shows it encrypted as well.

R1 show key chain (STEP 2)
RP/0/RP0/CPU0:R1#show key chain
Fri Sep 11 05:53:12.011 UTC

Key-chain: KC-OSPF -

  timezone -- local
  Key 1 -- text "0700325C48021C1C46"
    Cryptographic-Algorithm -- HMAC_MD5
    Send lifetime --  00:00:00, 01 Jan 2020 - Always valid  [Valid now]
    Accept lifetime -- 00:00:00, 01 Jan 2020 - Always valid [Valid now]

In the capture the type becomes Auth Type: Cryptographic (2) and Auth Crypt Data Length is 16. The digest itself is appended after the packet. Auth Crypt Sequence Number is a monotonically increasing value that defends against replaying a recorded packet.

No.3 Hello (MD5; Auth Crypt Data Length is 16)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x0000 (None)
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Cryptographic (2)
        Auth Crypt Key id: 1
        Auth Crypt Data Length: 16
        Auth Crypt Sequence Number: 1789105860
        Auth Crypt Data: f3be6f6190f302a73b4b99071c5d3fde
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 10.1.2.2
        Backup Designated Router: 10.1.2.1
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x0000
        LLS Data Length: 56 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000004
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8
        Crypto Authentication TLV
            TLV Type: 2
            TLV Length: 20
            Sequence number: 0x6aa396c4
            Auth Data: bb2d9f6e43f93bf3d125592e350d8006

Download the pcap of the packet in the tshark output above (No.3 Hello)

This is also where the per-link nature of authentication becomes visible. R2’s show ospf interface lists two interfaces. Gi0/0/0/0 towards R1 has the authentication lines; Gi0/0/0/1 towards R3 has not a single one in the same output. The R2 - R3 adjacency stays up without authentication.

R2 with an authenticated and an unauthenticated interface side by side (STEP 2)
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Keychain-based authentication enabled
    Keychain name KC-OSPF
    Key id used is 1
    Cryptographic algorithm HMAC_MD5_16
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never
GigabitEthernet0/0/0/1 is up, line protocol is up 
  Internet Address 10.2.3.2/24, Area 0, SID 0, Strict-SPF SID 0
  Label stack Primary label 0 Backup label 0 SRTE label 0
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1, MTU 1500, MaxPktSz 1500
  Forward reference No, Unnumbered no,  Bandwidth 1000000 
  RIB LC sync Yes
  Designated Router (ID) 2.2.2.2, Interface address 10.2.3.2
  Backup Designated router (ID) 3.3.3.3, Interface address 10.2.3.3
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:00:478
  Index 2/2, flood queue length 0
  Next 0(0)/0(0)
  Last flood scan length is 1, maximum is 2
  Last flood scan time is 0 msec, maximum is 0 msec
  LS Ack List: current length 0, high water mark 1
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 3.3.3.3  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Multi-area interface Count is 0

STEP 3: switch to HMAC-SHA-256

The key string stays the same; only the algorithm is replaced. The keychain on XRd 26.1.1 offered these algorithms.

Algorithms available in a keychain
AES-128-CMAC-96   HMAC-MD5      HMAC-SHA-256   HMAC-SHA1-12
HMAC-SHA1-20      HMAC-SHA1-96  MD5            SHA-1

Configuration applied in STEP 3
(apply to both R1 and R2)
key chain KC-OSPF
 key 1
  cryptographic-algorithm HMAC-SHA-256

The algorithm line in show ospf interface changes.

R1 Gi0/0/0/0 (HMAC-SHA-256, STEP 3)
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Keychain-based authentication enabled
    Keychain name KC-OSPF
    Key id used is 1
    Cryptographic algorithm HMAC-SHA-256
  Multi-area interface Count is 0

On the packet side, Auth Crypt Data Length goes from 16 to 32.

No.42 Hello (HMAC-SHA-256; Auth Crypt Data Length is 32)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x0000 (None)
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Cryptographic (2)
        Auth Crypt Key id: 1
        Auth Crypt Data Length: 32
        Auth Crypt Sequence Number: 1789106045
        Auth Crypt Data: 17dbf327138380c48f79512045ee29048f7f5ee887c0e9763eebbe8001fbdb67
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 10.1.2.2
        Backup Designated Router: 10.1.2.1
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x0000
        LLS Data Length: 72 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000004
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8
        Crypto Authentication TLV
            TLV Type: 2
            TLV Length: 36
            Sequence number: 0x6aa3977d
            Auth Data: 3c03c25d0614f54b6bda0b649d28a32a8bf479c1178a294ac7707434999c7d5a

Download the pcap of the packet in the tshark output above (No.42 Hello)

Because the digest grows by 16 bytes, the frame length itself grows from 154 to 186 bytes. The change starts with the Hello at 14:54:26, and the adjacency does not drop.

The frame length of R1 Hellos changes from 154 to 186
2026-09-11 14:53:57.562199     10.1.2.1 → 224.0.0.5    OSPF 154 Hello Packet
2026-09-11 14:54:07.263721     10.1.2.1 → 224.0.0.5    OSPF 154 Hello Packet
2026-09-11 14:54:16.344887     10.1.2.1 → 224.0.0.5    OSPF 154 Hello Packet
2026-09-11 14:54:26.309415     10.1.2.1 → 224.0.0.5    OSPF 186 Hello Packet
2026-09-11 14:54:36.189748     10.1.2.1 → 224.0.0.5    OSPF 186 Hello Packet

There is a short window where the two sides disagree. The adjacency survived here because both sides were changed within the Dead interval of 40 seconds. In production it is safer to separate the key IDs and switch as in the next STEP.

STEP 4: roll the key over

This is the operation you will actually use. It takes two stages. Changing the send key first would make the far end discard the packets, because it does not yet know that key.

Replacing a key without dropping the adjacency
Add the new key on both sides with accept-lifetime only; keep sending with the old key
Move sending to the new key on both sides (set send-lifetime on the new key, remove it from the old one)
Delete the old key

First add key 2 on both sides as receive-only: write accept-lifetime and no send-lifetime.

Configuration applied in STEP 4-1 (accept only)
(apply to both R1 and R2)
key chain KC-OSPF
 key 2
  accept-lifetime 00:00:00 january 01 2020 infinite
  cryptographic-algorithm HMAC-SHA-256
  key-string clear ospfkey2

Both sides now send with key 1 and accept either key. Next, move sending to key 2.

Configuration applied in STEP 4-2 (switch the send key)
(apply to both R1 and R2)
key chain KC-OSPF
 key 2
  send-lifetime 00:00:00 january 01 2020 infinite
 !
 key 1
  no send-lifetime

show key chain now shows key 1 as Send lifetime -- Not configured (receive only) and key 2 as [Valid now] for both directions.

R1 show key chain (two keys present, STEP 4)
RP/0/RP0/CPU0:R1#show key chain
Fri Sep 11 06:00:19.100 UTC

Key-chain: KC-OSPF -

  timezone -- local
  Key 1 -- text "0700325C48021C1C46"
    Cryptographic-Algorithm -- HMAC_SHA_256
    Send lifetime -- Not configured
    Accept lifetime -- 00:00:00, 01 Jan 2020 - Always valid [Valid now]

  Key 2 -- text "000B001602500E1F5D"
    Cryptographic-Algorithm -- HMAC_SHA_256
    Send lifetime --  00:00:00, 01 Jan 2020 - Always valid  [Valid now]
    Accept lifetime -- 00:00:00, 01 Jan 2020 - Always valid [Valid now]

On the OSPF side the output changes to Key id used is 2.

R1 Gi0/0/0/0 (using key 2, STEP 4)
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Keychain-based authentication enabled
    Keychain name KC-OSPF
    Key id used is 2
    Cryptographic algorithm HMAC-SHA-256
  Multi-area interface Count is 0

The adjacency never went down. Neighbor is up for is over 12 minutes, which reaches back to the recovery in STEP 1. The move to MD5, the move to HMAC-SHA-256 and the key rollover all happened within that time.

R1 the adjacency has stayed up (STEP 4)
RP/0/RP0/CPU0:R1#show ospf neighbor
Fri Sep 11 06:00:13.536 UTC

* Indicates MADJ interface
# Indicates Neighbor awaiting BFD session up

Neighbors for OSPF 1

Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2         1     FULL/DR         00:00:31    10.1.2.2        GigabitEthernet0/0/0/0
    Neighbor is up for 00:12:09

Total neighbor count: 1

The capture agrees: the Key ID in R1’s Hellos changes from 1 to 2 at 14:58:26, and the Hello interval stays at 10 seconds throughout.

The Key ID in R1 Hellos changes from 1 to 2
frame.number	_ws.col.cls_time	ospf.auth.crypt.key_id	ospf.auth.crypt.data_length
2026-09-11 14:57:38.057345	1	32
2026-09-11 14:57:47.830721	1	32
2026-09-11 14:57:57.492035	1	32
2026-09-11 14:58:07.300398	1	32
2026-09-11 14:58:16.426431	1	32
2026-09-11 14:58:26.183293	2	32
2026-09-11 14:58:35.699347	2	32
2026-09-11 14:58:44.738048	2	32
2026-09-11 14:58:53.906863	2	32
2026-09-11 14:59:03.431175	2	32

Here is the first packet after the change.

No.11 Hello (sent with key 2)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x0000 (None)
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Cryptographic (2)
        Auth Crypt Key id: 2
        Auth Crypt Data Length: 32
        Auth Crypt Sequence Number: 1789106279
        Auth Crypt Data: 2a6a1e689084e5190b163af1c3f9141f1d325c227e7fb97d45dfacbf65d18db9
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 10.1.2.2
        Backup Designated Router: 10.1.2.1
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x0000
        LLS Data Length: 72 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000004
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8
        Crypto Authentication TLV
            TLV Type: 2
            TLV Length: 36
            Sequence number: 0x6aa39867
            Auth Data: 01d3c53a9a853189b11c5b7d4afdb000869b2cea0321138318e1b39e6e249e07

Download the pcap of the packet in the tshark output above (No.11 Hello)

Skip stage 1 and change the send key first, and the far end discards the packets because it does not know that key ID; the adjacency drops when the Dead interval expires. Accept first, send second is the rule for key rollover.

STEP 5: combine area-level and interface-level

Add area-level authentication to area 0 on R1, leaving the interface-level keychain in place.

Configuration applied in STEP 5
(R1)
router ospf 1
 area 0
  authentication message-digest

Both are now configured.

R1 running-config (both area and interface, STEP 5)
router ospf 1
 router-id 1.1.1.1
 area 0
  authentication message-digest
  interface Loopback0
   passive enable
  !
  interface GigabitEthernet0/0/0/0
   authentication keychain KC-OSPF
  !
 !
!

The interface-level setting wins. The output still shows the keychain and the adjacency stays up. The area-level message-digest was not applied to this interface.

R1 Gi0/0/0/0 (interface level wins, STEP 5)
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Keychain-based authentication enabled
    Keychain name KC-OSPF
    Key id used is 2
    Cryptographic algorithm HMAC-SHA-256
  Multi-area interface Count is 0

STEP 6: remove authentication

Remove both the area-level and the interface-level configuration.

Configuration applied in STEP 6 (final state)
(R1)
router ospf 1
 area 0
  no authentication message-digest
  interface GigabitEthernet0/0/0/0
   no authentication keychain KC-OSPF

(R2)
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   no authentication keychain KC-OSPF

The authentication lines disappear and the interface is back to the STEP 0 state.

R1 Gi0/0/0/0 (back to no authentication, STEP 6)
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never

Design notes

Plain text authentication offers nothing against sniffing. If you are going to authenticate, use the cryptographic type, and pick HMAC-SHA where the far end supports it
Accept first, send second when replacing a key. Follow the order and the adjacency survives the change
A one-sided configuration is invisible until the Dead interval expires. No authentication error is logged, only dead timer expired, so compare both ends when an adjacency drops
send-lifetime and accept-lifetime depend on the device clock. If you rely on bounded lifetimes to switch keys automatically, keep the clocks synchronised with NTP

Verification configuration and show output

Three kinds of file were collected from all three routers at every STEP, one file per router. The verification configuration is the ..._run.txt file (the final state is the STEP 6 one).

File	Contents
`..._show.txt`	`show version` / `show interface description` / `show route` / `show route ospf` / `show ospf` / `show ospf interface` / `show ospf interface brief` / `show ospf neighbor` / `show ospf neighbor detail` / `show ospf database` / `show ospf database router` / `show ospf database network` / `show ospf statistics interface` / `show ospf interface GigabitEthernet0/0/0/0` / `show key chain`
`..._log.txt`	`show logging` narrowed to that STEP. A marker was written with `logmsg` at the start of each STEP and its timestamp passed to `show logging start`
`..._run.txt`	`show running-config` at that STEP (the verification configuration for that STEP)

STEP 0: No authentication - no authentication lines in the output

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 1: Configure plain text - the password is readable in the capture; one-sided configuration drops the adjacency

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 2: Switch to MD5 (keychain) - Auth Crypt Data Length is 16; the R2 - R3 link stays unauthenticated

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 3: Switch to HMAC-SHA-256 - Auth Crypt Data Length changes to 32

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 4: Add a key and roll over - Key ID goes from 1 to 2; the adjacency stays up

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 5: Add area-level authentication - the interface-level setting wins

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 6: Remove authentication (final state) - back to the unauthenticated state

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

The captures were taken on R1 - R2 and split into three files.

Download the capture of no authentication and plain text (STEP 0-1)

Download the capture of MD5 and HMAC-SHA-256 (STEP 2-3)

Download the capture of the key rollover and removal (STEP 4-6)

References

RFC	Title	Summary
RFC 2328	OSPF Version 2	Defines authentication: the AuType values (Appendix A.3.1) and the processing for AuType 0 / 1 / 2 (Appendix D).
RFC 5709	OSPFv2 HMAC-SHA Cryptographic Authentication	Extends AuType 2 cryptographic authentication to HMAC-SHA, and specifies that Auth Data Len equals the digest length of the algorithm.