Subject: RE: [manet] security performance evaluation

From: "Mullen, John P. (Contractor)" <[email-masked]>
Date: Wed, 11 Sep 2002 10:27:00 -0600

Hi Phillip,

Well, security is important.  However, to be effective, the key elements of
the security system need to be kept secret.  Any detail that becomes public
reduces the difficulty of the usurper's task.  (Remember the Allies were
able to decrypt the "unbreakable" Enigma code, in part, because German
operators got sloppy and did not change keys often enough.)  

:-)

This is an open forum, which means nothing discussed here is secret.

However, it is important that the MANET protocols do not complicate
security, which is why I say the main task in this group is to come up with
protocols that do not get in the way of security.

One approach is to make a public dummy version of the security system that
interacts with the protocol, but does not reveal its inner secrets.  That
would have to be designed by the security experts and signed off by the
security managers who would have to be convinced that revealing this much
wont lead to a security breach in the future.  

....

Well, it was an idea.

:-)

John Mullen

-----Original Message-----
From: Phillip Neumiller [mailto:[email-masked]]
Sent: Wednesday, September 11, 2002 10:07 AM
To: Mullen, John P. (Contractor); Phillip Neumiller; [email-masked]
Subject: RE: [manet] security performance evaluation

Just some follow-on ramblings...

I hear one of the security hawks swooping down on you John.  Before they
get here I will point out some reasons WHY MANET may need to be at least
partially involved in security.

Encryption at L2 is one thing.  Mode of operations is another.
We know that privacy and authentication are provided by OCB-AES as will
likely be used in IEEE 802 series products.  

The problem with this WEP fix is ad hoc mode has not been addressed 
adequatley (specifically the key distribution problem).  So I am not
sure that we can just say "son-of-WEP" fixes all of our problems for
802 type devices.  

If the whole L2 is encrypted, then only devices with a shared secret can
see each others messages, i.e. CSMA carrier sense becomes broken, 
MACA becomes broken, etc.   How does one gracefully acquire a key when
joining a group without credentials?  I think there are tons of 
issues here, the biggest one is probably accounting.  

Ad hoc networks will be most useful when they are used to extend the
global Internet, i.e. where one or more of the nodes provide backhaul
to the big I.  Aah, that is the key, then there is connectivity to 
Infrastructure and that opens doors to using a certificate authority,
IEEE 802.1X (EAP/LEAP) / Radius and a PKI.  Is this a MANET topic?

Commercializing MANETs will require security and there are definite
issues to address.  Mobility, handoff, roaming, and Internet access
themselves are billable services irrespective of the underlying 
network topology.  So addressing them in MANETs will be important
if we ever hope to make them commercially successful.  I would love
to see some standardization effort here in the MANET group.

Regards...
****************************************************************************
This e-mail is intended only for the addressee named above and may contain
confidential, proprietary or privileged information. If you are not the
named addressee or the person responsible for delivering the message to the
named addressee, please inform us promptly by reply e-mail, then delete the
e-mail and destroy any printed copy. The contents should not be disclosed to
anyone and no copies should be made. We take reasonable precautions to
ensure that our emails are virus free. However we accept no responsibility
for any virus transmitted by us and recommend that you subject any incoming
e-mail to your own virus checking procedures. 
_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Miguel Sanchez <[email-masked]>
Date: Wed, 11 Sep 2002 19:08:57 +0200

Hi John,

I may be missing something but it seems to me that ad-hoc networks are 
built by collaboration among network nodes. In some cases these nodes 
are not trusted to each other (ok, maybe not the case for a set of 
military gadgets).

Without any previous contact, unknown nodes should be considered, either 
safe or unsafe, by default. In the first case you are creating a 
friendly system even for the bad behaved nodes, in the second case it 
can be complex and difficult to join, but you may have a safer network.

The problem is that some ad-hoc networks are tightly associated to a 
high rate of node joins/leaves.

If we are using a private key system, like WEP, we need a central 
authority to create and to hand out the key. And we need the users to 
contact this authority by other means to get the key before they can 
join the ad-hoc network. This could work if all the users may have a 
simple and easy way to get the key, as far as they be really careful 
about keeping the key secret. Is this a typical ad-hoc scenario? I think 
mostly not with, maybe, the exception of military systems (and for them 
is what spies are for).

I think that a strong security system will kill the idea of a 
collaborative network. However I will be glad to be proved wrong, given 
we seem to agree security is an desirable property of an ad-hoc network. 
It is just I have the feeling that most of the security will be obtained 
by making a flat, peer-to-peer, ad-hoc network into a hierachical and 
somehow centralized system (you need a common security database).

I am with Phil about the "white box" approach to security design. (As 
you mention, Enigma code was cracked, as it has happened with WEP ... 
more recently). Of course this approach is not a guaratee of a 
fault-free system.

Regards,

Miguel Sanchez
Politechnic University of Valencia, Spain

---

From: Miguel Sanchez <[email-masked]>
Date: Wed, 11 Sep 2002 19:08:57 +0200

Hi John,

Regards,

Miguel Sanchez