Subject: RE: [manet] SAODV(corrected)

From: zhen <[email-masked]>
Date: Mon, 20 Jan 2003 11:41:50 -0400

I agree. But what if the node does not reply according to the AODV. Any node 
with the second signature can reply even though it actually does not have 
route to A.

still need instruction :)

regards

Zhen

>===== Original Message From 	Manel Guerrero Zapata 
<[email-masked]> =====
>Hi Zhen :)
>
>Well, RREQs are not something a bad guy wants to overhear.
>RREQs are broadcasted to everybody, so you don't need to
>play tricks to 'overhear' them, you hear them anyway.
>
>Then, any node having that information is not fooling by
>replying a node that initiates a RREQ to A. It's just
>replying according to the AODV protocol.
>
>Best regards,
>
>	Manel
>
>
>ext zhen wrote:
>> Hi, Manel,
>>
>> Thank you very much for the answer.
>>
>> But I am still confused. Any node in the network can overheard RREQ 
initiated
>> from a node(call it "A"). So it will have the second signature. Does that 
mean
>> any node having that information can fool those nodes that initiate RREQs 
to
>> "A" later by claiming it has the signature so "authenticated" route to "A"?
>>
>> I might be confused somewhere. I do appreciate your help.
>>
>>
>> Zhen
>>
>>>===== Original Message From 	Manel Guerrero Zapata
>>
>> <[email-masked]> =====
>>
>>>Hi :)
>>>
>>>If you are talking about the 'Signature for RREP' in the 'RREQ Double
>>
>> Signature
>>
>>>Extension', it is signed by the originatior of the RREQ. But it will not be
>>
>> used
>>
>>>for the RREP of this Route Request. As it says in section #7, it will be 
used
>>
>> by
>>
>>>some intermediate node when/if it receives a different RREQ that asks for 
the
>>>originator of the first RREQ.
>>>So, although it is signed by the originator (A) it will only be used for a
>>>different Route Request in which the destination is A.
>>>
>>>If you are talking about the 'Signature of the new Lifetime' in the 'RREP
>>>Double Signature Extension', it is signed by the intermediate node that
>>>originates the RREP (as it explains section #8).
>>>
>>>The use of Double signatures is optional. It is designed to allow
>>
>> intermediate
>>
>>>nodes to reply to RREQs but it is slightly less secure. So it is your
>>
>> desition
>>
>>>to use the sigle signatures (that it is more secure but does not allow
>>>intermediate nodes to reply) or the doble signatures. Desition that should,
>>
>> of
>>
>>>course, depend in your security requirements.
>>>
>>>I hope that it's more clear now.
>>>
>>>BR/Manel
>>>
>>>
>>>ext zhen wrote:
>>>
>>>hello,
>>>
>>>while reading SAODV, I can't understand the digital signature part very
>>>well. The second signature is signed by source or destination? If it is by
>>>the source, how come to prevent intermediate nodes from spoofing to have a
>>>route to the distination?
>>>
>>>thanks for any help
>>>
>>>Zhen
>>>
>>>_______________________________________________
>>>manet mailing list
>>>[email-masked]
>>>https://www1.ietf.org/mailman/listinfo/manet
>>>
>>
>> _______________________________________________
>> manet mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/manet

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Manel Guerrero Zapata <[email-masked]>
Date: Mon, 20 Jan 2003 18:52:28 +0200

Hi :)

 > I agree. But what if the node does not reply according to the AODV.

The only field that the node can change is the lifetime of
the route (the rest are validated by the signature, so they
are forced to be according to the AODV).

 > Any node

If you have received a RREQ then you _do_ have (or you had and
now it has expired) a route to A.

 > still need instruction :)

I hope this clarifies the thing.
And anyway, if you want a more secure approach use the SAODV
sigle signature extension instead of the double signature
extensions.

BR/Manel