Subject: RE: [manet] SAODV(corrected)

From: [email-masked]
Date: Wed, 22 Jan 2003 11:10:13 +0900

Hi, Manel, Zhen:

 > Any node
 > with the second signature can reply even though it actually does not have
 > route to A.

>If you have received a RREQ then you _do_ have (or you had and
>now it has expired) a route to A.
I remember some guy has mentioned "wormhole" attack here(manet ML).

Wormhole attack means that two malicious node cooperate with each other by establishing a VPN between each other.   When a malicious node "A" near the source node S receive a RREQ, it will forward this RREQ to malicious node "B" near the destination through this VPN.  As a result, "B" can claim to the destination D that it has the shortest path to source node S.
Similar to the "overhear" mentioned by zhen, I think it is difficult to use SAODV alone to prevent such attack.

BTW, I feel double signature is the most interesting part of SAODV for me, because it can utilize the route cache in the intermediate node.  Manel, do you know some rough estimation about the routing protocol performance degradation when we disable route reply in AODV/SAODV in intermediate node. 

yours
Leping

-----Original Message-----
From: ext Manel Guerrero Zapata [mailto:[email-masked]]
Sent: Tuesday, January 21, 2003 1:52 AM
To: ext zhen
Cc: [email-masked]
Subject: Re: [manet] SAODV(corrected)

Hi :)

 > I agree. But what if the node does not reply according to the AODV.

The only field that the node can change is the lifetime of
the route (the rest are validated by the signature, so they
are forced to be according to the AODV).

 > Any node
 > with the second signature can reply even though it actually does not have
 > route to A.

If you have received a RREQ then you _do_ have (or you had and
now it has expired) a route to A.

 > still need instruction :)

I hope this clarifies the thing.
And anyway, if you want a more secure approach use the SAODV
sigle signature extension instead of the double signature
extensions.

BR/Manel

> regards
> Zhen

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet
_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Manel Guerrero Zapata <[email-masked]>
Date: Wed, 22 Jan 2003 11:55:43 +0200

Hi Leping :)

Comments inlined.

BR/Manel Guerrero

> Hi, Manel, Zhen:

[...]

> Wormhole attack means that two malicious node cooperate with each other
 > by establishing a VPN between each other.   When a malicious node "A"
 > near the source node S receive a RREQ, it will forward this RREQ to
 > malicious node "B" near the destination through this VPN.  As a result,
 > "B" can claim to the destination D that it has the shortest path to
 > source node S.

You should read this paper:
Manel Guerrero Zapata and N. Asokan: "Securing Ad hoc Routing Protocols".
In Proceedings of the 2002 ACM Workshop on Wireless Security (WiSe 2002), pages 1-10. September 2002.

In there we have already answered that question:

| In addition, there is another type of attack that cannot be detected by
| SAODV: tunneling attacks. In that type of attack, two malicious nodes
| simulate that they have a link between them (that is, they can send
| and receive messages directly to each other). They achieve this by tunneling
| AODV messages between them (probably in an encrypted way). In this way they
| could achieve having certain traffic through them.
|
| In our opinion, no security scheme has been able, so far, to detect this.
| Misbehaving detection schemes could, in principle, detect the so-called tunnel
| attacks. If the monitor sees a routing message with Hop_Count = X + 1 being
| sent by a node but did not see a routing message with Hop_Count = X being
| sent to the same node, then the node is either fabricating the routing message
| or there is a tunnel. In either case it is cause for raising the alarm.
| Nevertheless, this kind of scheme has as main problems that there is no way for
| any node to validate the authenticity of the misbehavior reports and the there
| is the possibility of falsely detecting misbehavior nodes.  Therefore, we don't
| consider it as a feasible solution so far.

There is an updated version of the paper (just in case you don't have
access to the ACM portal) in:
http://ant.eupvg.upc.es/~tarom/guerrero_wise_2002.ps.gz

And some other related papers in:
http://ant.eupvg.upc.es/~tarom/saodv.html

This question should really go to an SADOV FAQ
because I think I already answered in this list. ;P

> BTW, I feel double signature is the most interesting part of SAODV for
 > me, because it can utilize the route cache in the intermediate node.
 > Manel, do you know some rough estimation about the routing protocol
 > performance degradation when we disable route reply in AODV/SAODV in
 > intermediate node.

I don't have any estimation about that, but of course it will really depend
on the mobility pattern of the nodes and on their communication pattern
(Do most of the nodes communicate with only a few nodes during a long
period? Are they having exchange of data with different nodes at the same time?)