OSPF Authentication

What OSPF authentication is

OSPF authentication is a way to verify that the router on the other end of a link is the expected one. Without it, OSPF does not check where a Hello came from. Anything that can put a Hello on the segment forms an adjacency, and LSAs start flowing in.

Authentication lives entirely in the OSPF header, in two fields: AuType (2 bytes) and Authentication (8 bytes), defined in RFC 2328 Appendix A.3.1. The header itself is covered in OSPF Packet Types and Header Format.

Method	AuType	What goes in the 8-byte `Authentication` field
None	`0`	Unused
Plaintext	`1`	The password itself. Anyone capturing the packet can read it
Cryptographic	`2`	Key ID, digest length and a sequence number. The digest is appended to the packet

A plaintext password only gets those 8 bytes; anything past the eighth character is never sent. Cryptographic authentication puts only the key information in those 8 bytes and appends a digest computed from the key, so the key itself never travels on the wire.

Authentication is configured per interface

RFC 2328 Appendix D defines the authentication type as per interface (equivalently, per network or subnet). A single router can use a different method and a different key on each link.

On IOS XR it goes under the interface inside the OSPF process.

Per interface (applies to this link only)
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   authentication keychain KC-OSPF

Put it under the area instead and it becomes the default for every interface in that area. A per-interface setting wins over it, so authentication null on one interface brings just that link back to no authentication.

Per area (applies to every interface in the area)
router ospf 1
 area 0
  authentication message-digest
  interface GigabitEthernet0/0/0/1
   authentication null

The area-wide form is convenient, but it drops any link you forget. Configure it on only some of the routers in an area and those routers send authenticated Hellos that the others discard, so the adjacency on that link goes down.

Keys are managed in a keychain

Keys for cryptographic authentication are not written into the OSPF configuration directly; they live in a keychain. One keychain holds several keys, and each key has separate periods for receiving and for sending (KeyStartAccept / KeyStartGenerate / KeyStopGenerate / KeyStopAccept in RFC 2328 Appendix D).

Keychain configuration (IOS XR)
key chain KC-OSPF
 key 1
  key-string clear <password>
  cryptographic-algorithm HMAC-SHA-256
  accept-lifetime 00:00:00 january 01 2020 infinite
  send-lifetime 00:00:00 january 01 2020 infinite

The algorithm decides the digest length. Because it changes the packet length, a capture shows which one is in use.

Algorithm	Digest length	Defined in
MD5	16 bytes	RFC 2328 Appendix D
HMAC-SHA-256	32 bytes	RFC 5709

A key ID only has to be unique per interface, and both ends must agree on the ID, the password and the algorithm.

Adding a key does not change the key used for sending

Adding a new key to a keychain does not immediately change which key is used for sending. RFC 2328 Appendix D.4.3 says the sending side picks, among the keys valid for generation, the one with the most recent KeyStartGenerate. If the new key starts generating at the same time as the old one, the implementation keeps using the old key.

That is why a hitless key change goes accept first, send second.

Allow the new key for receiving only on both ends (write accept-lifetime only)
Move both ends to sending with the new key (add send-lifetime to the new key and stop it on the old key)

Nothing happens at step 1 because both ends still send with the old key. At step 2 the ends can be switched one at a time, because each side already accepts either key.

A mismatch drops the adjacency, but not right away

A packet whose authentication does not match is discarded silently. There is no mechanism to tell the sender that the authentication was wrong. Hellos simply stop arriving, so the adjacency only goes down when the dead interval (40 seconds by default) expires.

Two different durations are involved here.

Until the adjacency drops: waiting for the dead interval. Seconds
Until traffic moves: the SPF run and the FIB update after the adjacency is gone. Milliseconds

When only one direction breaks (the packets you send are discarded, but not the ones you receive), only the other end’s dead timer expires. You keep receiving its Hellos, but your own router ID disappears from the neighbor list in them, so the adjacency is no longer bidirectional and falls back to INIT.

Test topology

Four IOS XR routers (XRd 26.1.1), with authentication configured only on the R1 - R2 link. R2 - R3 is left unauthenticated as the per-interface counter-example. R1 - R4 - R2 is a detour with cost 10, which is where traffic goes when R1 - R2 drops.

Router	Router ID	Management IP	Role
R1	1.1.1.1	10.19.3.59	The end being configured
R2	2.2.2.2	10.19.3.60	The other end. Its link to R3 stays unauthenticated
R3	3.3.3.3	10.19.3.64	Behind the unauthenticated link. Also the source of the ping
R4	4.4.4.4	10.19.3.65	Detour (cost 10)

The test runs in thirteen steps.

The sections below are grouped by topic rather than by step number.

Plaintext authentication puts the password on the wire

STEP 1 enables plaintext authentication on R1’s Gi0/0/0/0 only. authentication-key is the password and authentication selects the method (AuType 1). The running configuration shows the password encrypted.

STEP 1: plaintext authentication on R1 only
RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Mon Sep 28 02:46:38.634 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   authentication-key encrypted 000F121C1157040100325C48
   authentication
  !
 !
!
end

R1 and R2 now disagree. Both directions break, so both dead timers expire and both ends log the loss of the adjacency: R2 30.1 seconds after the commit and R1 32.0 seconds after.

STEP 1: syslog on R1
RP/0/RP0/CPU0:Sep 28 02:46:40.464 UTC: ssh_syslog_proxy[1188]: %SECURITY-SSHD_SYSLOG_PRX-6-INFO_GENERAL : sshd[6794]: Disconnected from user cisco 10.20.1.1 port 40876 
RP/0/RP0/CPU0:Sep 28 02:47:10.133 UTC: ospf[1035]: %ROUTING-OSPF-5-ADJCHG : Process 1, Nbr 2.2.2.2 on GigabitEthernet0/0/0/0 in area 0 from FULL to DOWN, Neighbor Down: dead timer expired, vrf default vrfid 0x60000000 

STEP 1: syslog on R2
RP/0/RP0/CPU0:Sep 28 02:45:07.920 UTC: ssh_syslog_proxy[1188]: %SECURITY-SSHD_SYSLOG_PRX-6-INFO_GENERAL : sshd[6377]: Disconnected from user cisco 10.20.1.1 port 38838 
RP/0/RP0/CPU0:Sep 28 02:47:08.266 UTC: ospf[1035]: %ROUTING-OSPF-5-ADJCHG : Process 1, Nbr 1.1.1.1 on GigabitEthernet0/0/0/0 in area 0 from FULL to DOWN, Neighbor Down: dead timer expired, vrf default vrfid 0x60000000 

Forwarding is a different order of magnitude. A ping of 900 packets at 100 ms intervals ran from R3 to 1.1.1.1 across the configuration change, and not one packet was lost (900/900). The gap between the last ICMP over R1 - R2 and the first ICMP over the R1 - R4 detour is 99.7 milliseconds, so the switch fits inside a single ping interval.

STEP 1: the last ICMP over R1 - R2 (0.7 s around the switch)
2026-09-28T11:47:08.052496000+0900	3.3.3.3	1.1.1.1	351
2026-09-28T11:47:08.054700000+0900	1.1.1.1	3.3.3.3	351
2026-09-28T11:47:08.152576000+0900	3.3.3.3	1.1.1.1	352
2026-09-28T11:47:08.154623000+0900	1.1.1.1	3.3.3.3	352
2026-09-28T11:47:08.253070000+0900	3.3.3.3	1.1.1.1	353
2026-09-28T11:47:08.255245000+0900	1.1.1.1	3.3.3.3	353
2026-09-28T11:47:08.353982000+0900	3.3.3.3	1.1.1.1	354
2026-09-28T11:47:08.356487000+0900	1.1.1.1	3.3.3.3	354

STEP 1: the first ICMP over R1 - R4, the detour (same 0.7 s)
2026-09-28T11:47:08.456223000+0900	3.3.3.3	1.1.1.1	355
2026-09-28T11:47:08.458460000+0900	1.1.1.1	3.3.3.3	355
2026-09-28T11:47:08.556514000+0900	3.3.3.3	1.1.1.1	356
2026-09-28T11:47:08.558910000+0900	1.1.1.1	3.3.3.3	356
2026-09-28T11:47:08.657181000+0900	3.3.3.3	1.1.1.1	357
2026-09-28T11:47:08.659706000+0900	1.1.1.1	3.3.3.3	357

STEP 2 adds the same password on R2 and the adjacency comes back. Capturing a Hello at that point shows the password in the clear.

STEP 2: a Hello once both ends authenticate (R1 to R2)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 44
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0xea9b [correct]
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Simple password (1)
        Auth Data (Simple): kazulogo
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 0.0.0.0
        Backup Designated Router: 0.0.0.0
    OSPF LLS Data Block
        Checksum: 0x7fc6
        LLS Data Length: 32 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000002
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8

Download the pcap of the packet in the tshark output above (Hello)

The configured password is kazulogospf (11 characters), but what appears is kazulogo (8 characters). The Authentication field is only 8 bytes, so nothing past the eighth character is carried. Both ends end up with the same 8 bytes so the adjacency forms, but the rest of the password adds no strength.

The digest length depends on the algorithm

STEP 3 moves both ends to cryptographic authentication with a keychain (MD5, key 1). The plaintext authentication-key is removed and replaced with authentication keychain.

STEP 3: move R1 to a keychain (MD5)
RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Mon Sep 28 02:59:44.705 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
key chain KC-OSPF
 key 1
  accept-lifetime 00:00:00 january 01 2020 infinite
  key-string password 0118071E4E0709082A495758
  send-lifetime 00:00:00 january 01 2020 infinite
  cryptographic-algorithm MD5
 !
!
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   no authentication-key encrypted 000F121C1157040100325C48
   authentication keychain KC-OSPF
  !
 !
!
end

The Hello becomes Auth Type: Cryptographic (2), and the 8-byte field carries Auth Crypt Key id and Auth Crypt Data Length. The digest itself (Auth Crypt Data) is appended after the OSPF packet, and here it is 16 bytes.

STEP 3: an MD5 Hello (R1 to R2)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x0000 (None)
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Cryptographic (2)
        Auth Crypt Key id: 1
        Auth Crypt Data Length: 16
        Auth Crypt Sequence Number: 1790564360
        Auth Crypt Data: 10a3f63aeeef318548fc9aad2d2bcd6f
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 0.0.0.0
        Backup Designated Router: 0.0.0.0
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x0000
        LLS Data Length: 56 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000002
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8
        Crypto Authentication TLV
            TLV Type: 2
            TLV Length: 20
            Sequence number: 0x6ab9d808
            Auth Data: 8401e287670f622907126fed5eaf7ee4

Download the pcap of the packet in the tshark output above (MD5 Hello)

STEP 4 changes key 1 to HMAC-SHA-256. The key ID stays the same while Auth Crypt Data Length becomes 32 and Auth Crypt Data doubles in length.

STEP 4: an HMAC-SHA-256 Hello (R1 to R2)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 1.1.1.1
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x0000 (None)
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Cryptographic (2)
        Auth Crypt Key id: 1
        Auth Crypt Data Length: 32
        Auth Crypt Sequence Number: 1790564668
        Auth Crypt Data: 7c7534fc8fdbeca415aca46a2c82479f2773c08beff2916c56e01dfafb2bfc59
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 0.0.0.0
        Backup Designated Router: 0.0.0.0
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x0000
        LLS Data Length: 72 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000002
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8
        Crypto Authentication TLV
            TLV Type: 2
            TLV Length: 36
            Sequence number: 0x6ab9d93c
            Auth Data: 009d37ffd911e8a06bd1f435e6a75f24d543db1016965afbd1d39faf5fc9872e

Download the pcap of the packet in the tshark output above (HMAC-SHA-256 Hello)

On the router, show ospf interface tells you which method is active. With a keychain it reads Keychain-based authentication enabled.

STEP 4: show ospf interface GigabitEthernet0/0/0/0 on R1
RP/0/RP0/CPU0:R1#show ospf interface GigabitEthernet0/0/0/0
Mon Sep 28 03:07:46.736 UTC

GigabitEthernet0/0/0/0 is up, line protocol is up 
  Internet Address 10.0.12.1/24, Area 0, SID 0, Strict-SPF SID 0
  Label stack Primary label 0 Backup label 0 SRTE label 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 1
  Transmit Delay is 1 sec, State POINT_TO_POINT, MTU 1500, MaxPktSz 1500
  Forward reference No, Unnumbered no,  Bandwidth 1000000 
  RIB LC sync Yes
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:01:400
  Index 1/1, flood queue length 0
  Next 0(0)/0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  LS Ack List: current length 0, high water mark 2
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2
  Suppress hello for 0 neighbor(s)
  Keychain-based authentication enabled
    Keychain name KC-OSPF
    Key id used is 1
    Cryptographic algorithm HMAC-SHA-256
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never

Adding a key does not change what is sent

STEP 5 adds key 2 (HMAC-SHA-256) on R1 alone, valid for both sending and receiving.

STEP 5: add key 2 on R1 (send and accept)
RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Mon Sep 28 03:10:19.920 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
key chain KC-OSPF
 key 2
  accept-lifetime 00:00:00 january 01 2020 infinite
  key-string password 070420565B0516021C17125E
  send-lifetime 00:00:00 january 01 2020 infinite
  cryptographic-algorithm HMAC-SHA-256
 !
!
end

In show key chain, both key 1 and key 2 are [Valid now] for sending as well as receiving.

STEP 5: show key chain on R1
RP/0/RP0/CPU0:R1#show key chain
Mon Sep 28 03:12:57.531 UTC

Key-chain: KC-OSPF -

  timezone -- local
  Key 1 -- text "0118071E4E0709082A495758"
    Cryptographic-Algorithm -- HMAC_SHA_256
    Send lifetime --  00:00:00, 01 Jan 2020 - Always valid  [Valid now]
    Accept lifetime -- 00:00:00, 01 Jan 2020 - Always valid [Valid now]

  Key 2 -- text "070420565B0516021C17125E"
    Cryptographic-Algorithm -- HMAC_SHA_256
    Send lifetime --  00:00:00, 01 Jan 2020 - Always valid  [Valid now]
    Accept lifetime -- 00:00:00, 01 Jan 2020 - Always valid [Valid now]

Even so, R1 keeps sending with key 1. Listing the key ID and digest length of every Hello R1 sent during this step produces nothing but 1 and 32.

STEP 5: key ID and digest length of every Hello R1 sent
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32
32

STEP 6 stops the send lifetime of key 1, and R1 starts sending with key 2. R2 does not know key 2, so this is where the mismatch begins.

STEP 6: stop the send lifetime of key 1 on R1
RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Mon Sep 28 03:15:28.657 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
key chain KC-OSPF
 key 1
  no send-lifetime 00:00:00 january 01 2020 infinite
 !
!
end

Only the R1 to R2 direction breaks. R1 keeps receiving R2’s Hellos so its own dead timer never expires; it falls back to INIT because its router ID disappears from the neighbor list in those Hellos. Only R2 logs the loss, 39.6 seconds after the commit. That is later than the 30.1 seconds in STEP 1 because R2’s dead timer starts from the last Hello R1 sent with key 1, which shifts it by one Hello interval (10 seconds).

STEP 6: syslog on R2
RP/0/RP0/CPU0:Sep 28 03:13:56.659 UTC: ssh_syslog_proxy[1188]: %SECURITY-SSHD_SYSLOG_PRX-6-INFO_GENERAL : sshd[11959]: Disconnected from user cisco 10.20.1.1 port 43294 
RP/0/RP0/CPU0:Sep 28 03:16:07.784 UTC: ospf[1035]: %ROUTING-OSPF-5-ADJCHG : Process 1, Nbr 1.1.1.1 on GigabitEthernet0/0/0/0 in area 0 from FULL to DOWN, Neighbor Down: dead timer expired, vrf default vrfid 0x60000000 

STEP 7 restores the send lifetime of key 1 and the adjacency recovers.

Changing keys without dropping the adjacency

The correct order is accept first, send second. STEP 8 adds key 2 on R2 with only accept-lifetime. With no sending period, R2 can receive key 2 but will not use it to send.

STEP 8: add key 2 on R2 for receiving only
RP/0/RP0/CPU0:R2#show configuration commit changes last 1
Mon Sep 28 03:28:26.328 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
key chain KC-OSPF
 key 2
  accept-lifetime 00:00:00 january 01 2020 infinite
  key-string password 000F121C115704010424551C
  cryptographic-algorithm HMAC-SHA-256
 !
!
end

At this point both ends send with key 1 and accept either key. STEP 9 moves both ends to sending with key 2.

STEP 9: switch R1 to sending with key 2
RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Mon Sep 28 03:33:10.518 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
key chain KC-OSPF
 key 1
  no send-lifetime 00:00:00 january 01 2020 infinite
 !
 key 2
  send-lifetime 00:00:00 january 01 2020 infinite
 !
!
end

The key ID in the Hellos R1 sends changes from 1 to 2 at the moment of the switch.

STEP 9: key ID of every Hello R1 sent, with timestamps
2026-09-28T12:33:01.245449000+0900	1
2026-09-28T12:33:10.819064000+0900	2
2026-09-28T12:33:20.442057000+0900	2
2026-09-28T12:33:30.209365000+0900	2
2026-09-28T12:33:39.606135000+0900	2
2026-09-28T12:33:48.883604000+0900	2
2026-09-28T12:33:58.670707000+0900	2
2026-09-28T12:34:08.334187000+0900	2
2026-09-28T12:34:17.612667000+0900	2
2026-09-28T12:34:27.417014000+0900	2
2026-09-28T12:34:36.669876000+0900	2
2026-09-28T12:34:46.329512000+0900	2
2026-09-28T12:34:56.223066000+0900	2
2026-09-28T12:35:05.839839000+0900	2
2026-09-28T12:35:15.746548000+0900	2
2026-09-28T12:35:24.953261000+0900	2
2026-09-28T12:35:34.319100000+0900	2
2026-09-28T12:35:44.173105000+0900	2
2026-09-28T12:35:54.010739000+0900	2
2026-09-28T12:36:03.973249000+0900	2
2026-09-28T12:36:13.218704000+0900	2
2026-09-28T12:36:22.220105000+0900	2
2026-09-28T12:36:31.637461000+0900	2
2026-09-28T12:36:41.218468000+0900	2
2026-09-28T12:36:50.907313000+0900	2
2026-09-28T12:37:00.266247000+0900	2
2026-09-28T12:37:09.840607000+0900	2
2026-09-28T12:37:18.978877000+0900	2
2026-09-28T12:37:28.966898000+0900	2
2026-09-28T12:37:38.648102000+0900	2
2026-09-28T12:37:48.629419000+0900	2
2026-09-28T12:37:58.292910000+0900	2
2026-09-28T12:38:08.220736000+0900	2
2026-09-28T12:38:17.511246000+0900	2
2026-09-28T12:38:26.701885000+0900	2
2026-09-28T12:38:35.837746000+0900	2
2026-09-28T12:38:45.400570000+0900	2
2026-09-28T12:38:54.654058000+0900	2
2026-09-28T12:39:03.893012000+0900	2
2026-09-28T12:39:13.716348000+0900	2

The adjacency state never changes during this step. R1’s syslog contains no ADJCHG at all, and all 900 pings from R3 to 1.1.1.1 are answered. Because receiving was allowed first, the ends can be out of step on the sending side without breaking anything.

Area-wide authentication reaches every interface in the area

STEP 10 adds authentication message-digest to area 0 on all four routers. The R2 - R3 link, which has no keychain at all, gets authentication too.

STEP 10: add area-wide authentication on R3
RP/0/RP0/CPU0:R3#show configuration commit changes last 1
Mon Sep 28 03:39:50.326 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 0
  authentication message-digest
 !
!
end

Hellos on that link become Auth Type: Cryptographic (2) with Auth Crypt Key id of 0 and Auth Crypt Data Length of 16 bytes (MD5). The key ID is 0 because no key is configured.

STEP 10: a Hello on R2 - R3 (R3 to R2)
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: Hello Packet (1)
        Packet Length: 48
        Source OSPF Router: 3.3.3.3
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x0000 (None)
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Cryptographic (2)
        Auth Crypt Key id: 0
        Auth Crypt Data Length: 16
        Auth Crypt Sequence Number: 1790566706
        Auth Crypt Data: faf5961b72f123231828f7f085faad5e
    OSPF Hello Packet
        Network Mask: 255.255.255.0
        Hello Interval [sec]: 10
        Options: 0x12, (L) LLS Data block, (E) External Routing
            0... .... = DN: Not set
            .0.. .... = (O) Opaque: Not set
            ..0. .... = (DC) Demand Circuits: Not supported
            ...1 .... = (L) LLS Data block: Present
            .... 0... = (N) NSSA: Not supported
            .... .0.. = (MC) Multicast: Not capable
            .... ..1. = (E) External Routing: Capable
            .... ...0 = (MT) Multi-Topology Routing: No
        Router Priority: 1
        Router Dead Interval [sec]: 40
        Designated Router: 0.0.0.0
        Backup Designated Router: 0.0.0.0
        Active Neighbor: 2.2.2.2
    OSPF LLS Data Block
        Checksum: 0x0000
        LLS Data Length: 56 bytes
        Extended options TLV
            TLV Type: 1
            TLV Length: 4
            Options: 0x00000001, (LR) LSDB Resynchronization
                .... .... .... .... .... .... .... ..0. = (RS) Restart Signal: Not set
                .... .... .... .... .... .... .... ...1 = (LR) LSDB Resynchronization: Set
        Local Interface ID
            TLV Type: 18
            TLV Length: 4
            Local Interface ID: 00000004
        Unknown LLS TLV
            TLV Type: 32768
            TLV Length: 8
        Crypto Authentication TLV
            TLV Type: 2
            TLV Length: 20
            Sequence number: 0x6ab9e132
            Auth Data: 17f6fe60a307b1f1826750a2c03304b9

Download the pcap of the packet in the tshark output above (area-wide authentication Hello)

The router-side display changes to Message digest authentication enabled as well.

STEP 10: show ospf interface GigabitEthernet0/0/0/0 on R3
RP/0/RP0/CPU0:R3#show ospf interface GigabitEthernet0/0/0/0
Mon Sep 28 03:43:51.673 UTC

GigabitEthernet0/0/0/0 is up, line protocol is up 
  Internet Address 10.0.23.3/24, Area 0, SID 0, Strict-SPF SID 0
  Label stack Primary label 0 Backup label 0 SRTE label 0
  Process ID 1, Router ID 3.3.3.3, Network Type POINT_TO_POINT, Cost: 1
  Transmit Delay is 1 sec, State POINT_TO_POINT, MTU 1500, MaxPktSz 1500
  Forward reference No, Unnumbered no,  Bandwidth 1000000 
  RIB LC sync Yes
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:07:223
  Index 1/1, flood queue length 0
  Next 0(0)/0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2
  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled
      No key configured, using default key id 0
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never

Nothing drops here because all four routers got the command, but configuring only some of them takes down the links to the others. To exempt an interface, put authentication null on it.

STEP 11: bring the R3 interface back to no authentication
RP/0/RP0/CPU0:R3#show configuration commit changes last 1
Mon Sep 28 03:45:18.859 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   authentication null
  !
 !
!
end

The AuType in the Hellos returns to 0 with the first Hello after the command.

STEP 11: AuType of every Hello R3 sent, with timestamps
2026-09-28T12:45:06.032688000+0900	2
2026-09-28T12:45:15.421528000+0900	2
2026-09-28T12:45:25.328700000+0900	0
2026-09-28T12:45:34.637104000+0900	0
2026-09-28T12:45:44.471771000+0900	0
2026-09-28T12:45:54.320344000+0900	0
2026-09-28T12:46:03.679524000+0900	0
2026-09-28T12:46:13.305059000+0900	0
2026-09-28T12:46:23.234325000+0900	0
2026-09-28T12:46:33.116943000+0900	0
2026-09-28T12:46:42.690442000+0900	0
2026-09-28T12:46:52.045485000+0900	0
2026-09-28T12:47:01.994242000+0900	0
2026-09-28T12:47:11.710785000+0900	0
2026-09-28T12:47:21.160445000+0900	0
2026-09-28T12:47:30.192371000+0900	0
2026-09-28T12:47:39.521840000+0900	0
2026-09-28T12:47:48.647714000+0900	0
2026-09-28T12:47:58.331103000+0900	0
2026-09-28T12:48:08.290733000+0900	0
2026-09-28T12:48:18.188155000+0900	0
2026-09-28T12:48:27.972574000+0900	0
2026-09-28T12:48:37.708370000+0900	0
2026-09-28T12:48:47.070248000+0900	0
2026-09-28T12:48:56.814595000+0900	0
2026-09-28T12:49:06.523888000+0900	0
2026-09-28T12:49:16.021777000+0900	0
2026-09-28T12:49:25.921430000+0900	0
2026-09-28T12:49:35.129437000+0900	0
2026-09-28T12:49:44.398471000+0900	0
2026-09-28T12:49:53.472347000+0900	0
2026-09-28T12:50:03.370638000+0900	0
2026-09-28T12:50:12.677707000+0900	0

The authentication line disappears from the router display as well (the Message digest authentication enabled seen in STEP 10 is gone).

STEP 11: show ospf interface GigabitEthernet0/0/0/0 on R3
RP/0/RP0/CPU0:R3#show ospf interface GigabitEthernet0/0/0/0
Mon Sep 28 03:49:17.003 UTC

GigabitEthernet0/0/0/0 is up, line protocol is up 
  Internet Address 10.0.23.3/24, Area 0, SID 0, Strict-SPF SID 0
  Label stack Primary label 0 Backup label 0 SRTE label 0
  Process ID 1, Router ID 3.3.3.3, Network Type POINT_TO_POINT, Cost: 1
  Transmit Delay is 1 sec, State POINT_TO_POINT, MTU 1500, MaxPktSz 1500
  Forward reference No, Unnumbered no,  Bandwidth 1000000 
  RIB LC sync Yes
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:08:144
  Index 1/1, flood queue length 0
  Next 0(0)/0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  LS Ack List: current length 0, high water mark 3
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2
  Suppress hello for 0 neighbor(s)
  Multi-area interface Count is 0
  Segment Routing Forwarding MPLS enabled: Yes
  Adjacency hold timer expired last : Never
  Exchange timer expired last : Never

Configuration and show output from the test

Every step was collected from all four routers, split by router and by kind. The configuration under test is the ..._run.txt (the final state is the one from STEP 12).

File	Contents
`..._show.txt`	The show set (`show version` / `show interface description` / `show route` / `show route ospf` / `show ospf` / `show ospf interface` / `show ospf neighbor` / `show ospf database` / `show key chain` / `show ospf interface GigabitEthernet0/0/0/0` and more)
`..._log.txt`	`show logging` limited to that step. A marker is written with `logmsg` at the start of each step and its timestamp is passed to `show logging start`
`..._run.txt`	`show running-config` at that step (that is, the configuration under test)
`..._ping.txt`	`ping` and `traceroute` for that step
`..._trace.txt`	`show ospf trace events`
`..._clear.txt`	A record of the counters cleared before collecting
`..._commit.cfg`	Only what was actually committed in that step (`show configuration commit changes last 1`), for the routers that were changed
`..._outage.txt`	A ping that spans the configuration change (900 packets at 100 ms). It is started before the change so that an outage can be measured

STEP 0: Initial state (no authentication)

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	—	—
R2	show	log	run	—	trace	clear	—	—
R3	show	log	run	ping	trace	clear	—	—
R4	show	log	run	—	trace	clear	—	—

STEP 1: Enable plaintext authentication on R1 only

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	—	—
R3	show	log	run	ping	trace	clear	—	outage
R4	show	log	run	—	trace	clear	—	—

STEP 2: Add the same password on R2

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	—	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	—	outage
R4	show	log	run	—	trace	clear	—	—

STEP 3: Move both ends to a keychain (MD5, key 1)

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	—	—
R4	show	log	run	—	trace	clear	—	—

STEP 4: Change key 1 to HMAC-SHA-256

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	—	—
R4	show	log	run	—	trace	clear	—	—

STEP 5: Add key 2 on R1 (both send and accept)

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	—	—
R3	show	log	run	ping	trace	clear	—	—
R4	show	log	run	—	trace	clear	—	—

STEP 6: Stop the send lifetime of key 1 on R1

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	—	—
R3	show	log	run	ping	trace	clear	—	outage
R4	show	log	run	—	trace	clear	—	—

STEP 7: Restore the send lifetime of key 1 on R1

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	—	—
R3	show	log	run	ping	trace	clear	—	outage
R4	show	log	run	—	trace	clear	—	—

STEP 8: Add key 2 on R2 with accept only

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	—	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	—	—
R4	show	log	run	—	trace	clear	—	—

STEP 9: Switch both ends to send with key 2

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	—	outage
R4	show	log	run	—	trace	clear	—	—

STEP 10: Add area-wide authentication on all four routers

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	commit	—
R4	show	log	run	—	trace	clear	commit	—

STEP 11: Put authentication null on the exempt link

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	commit	—
R4	show	log	run	—	trace	clear	commit	—

STEP 12: Remove the authentication and the keychain (final state) (final state)

Router	show	syslog	running-config	ping	trace	clear	commit	outage
R1	show	log	run	ping	trace	clear	commit	—
R2	show	log	run	—	trace	clear	commit	—
R3	show	log	run	ping	trace	clear	commit	—
R4	show	log	run	—	trace	clear	commit	—

Packet captures were taken per step on three segments.

STEP	R1-R2 (authenticated)	R2-R3 (not authenticated)	R1-R4 (detour)
0	pcap	pcap	pcap
1	pcap	pcap	pcap
2	pcap	pcap	pcap
3	pcap	pcap	pcap
4	pcap	pcap	pcap
5	pcap	pcap	pcap
6	pcap	pcap	pcap
7	pcap	pcap	pcap
8	pcap	pcap	pcap
9	pcap	pcap	pcap
10	pcap	pcap	pcap
11	pcap	pcap	pcap
12	pcap	pcap	pcap

Design notes

Plaintext authentication offers no protection against capture. The password travels in the clear and only 8 bytes of it are carried. Use cryptographic authentication instead
Change keys accept first, send second. Follow that order and the adjacency stays up
A mismatch leaves no reason in syslog. All you get is dead timer expired, so when an adjacency drops, compare the configuration on both ends
send-lifetime and accept-lifetime depend on the router clock. If the rollover is to happen automatically at a given time, the clocks have to be in sync with NTP

References

RFC	Title	Summary
RFC 2328	OSPF Version 2	Defines authentication: the `AuType` and `Authentication` fields (Appendix A.3.1) and the handling of AuType 0 / 1 / 2 together with the four key times (Appendix D, D.4.3).
RFC 5709	OSPFv2 HMAC-SHA Cryptographic Authentication	Extends AuType 2 to HMAC-SHA, defining the digest length as the output length of the algorithm.