Subject: Re: [manet] one way hash in SAODV

From: [email-masked]
Date: Tue, 7 Jan 2003 17:33:03 -0500 (EST)

>BUT, in my opinion it makes no sense to try protect the routing layer
>because if I want to do a DoS, I'll do it at physical or link layer
>(where it is much more easy and routing protocol independent).

This is a typical argument for neglecting routing protocol security.
My typical response is:

One might do a DOS attack against one router and thereby affect the
packets that are forwarded through that router.  One might be able
to subvert a router and do a DOS attack on all packets that are
forwarded through that router.

But if you can do an attack on the exchange of routing information
between routers (i.e., an attack on the routing layer), then one has
the opportunity to affect the forwarding of packets over, potentially,
*T*H*E* *E*N*T*I*R*E* *N*E*T*W*O*R*K*.

Much different scope of damage.

Attacking through the physical or link layer allows you to damage
everything directly attached to that physical medium or that link.

Because routing information is in the network layer, attacking the
routing layer lets you damage the whole network with one attack.

--Sandy
_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: "Timothy J. Salo" <[email-masked]>
Date: Tue, 7 Jan 2003 17:53:14 -0600 (CST)

> From: [email-masked]
> Date: Tue, 7 Jan 2003 17:33:03 -0500 (EST)
> Subject: Re: [manet] one way hash in SAODV
> 	[...]

Who may be too modest to reference her Internet-Draft
on the topic, but which may be relevant:

	ftp://ftp.tislabs.com/pub/rpsec/draft-murphy-threat-00.txt

-tjs

---

From: Panos Papadimitratos <[email-masked]>
Date: Wed, 08 Jan 2003 15:48:28 -0500

Dear All,

Indeed, the security of the routing protocol is of great importance, exactly
because of the scope of the attack. This is especially true in MANET, since
practically all nodes may act as both hosts and routers. Additionally, MANET
routing (route/topology discovery) cannot benefit from pre-configured
connectivity and pre-established authorizations granted to routers to
advertise specific control/routing information (as can be the case for the
wire-line Internet).

Moreover, it can be very hard to maintain an up-to-date picture of the 
credentials of *all*
present nodes in a MANET domain (roaming nodes join and leave open wireless 
network
domains). Or, it can be of limited scope to assume such prior full 
knowledge. In addition,
the limited processing capabilities of the mobile nodes make the use of 
asymmetric
cryptography at each hop very expensive in the general case.

All these considerations are very important for a generally applicable, 
practical
solution for MANET secure routing.

This what we are after with our Secure Routing Protocol (SRP), which:
  - requires cryptographic operations only at the end-nodes (and thus no 
secure
    association with any intermediate node),
  - uses symmetric key crypto at the end nodes only
  - is resilient to denial of service attacks against route discovery
    (it can even tolerate a Byzantine destination node that tries to 
provide the
     querying source with a false route :-)
  - does not rely on the detection and isolation of malicious nodes
And, of course, provides correct routing information.

To probe further, please see some SRP-related links below
http://www.ietf.org/internet-drafts/draft-papadimitratos-secure-routing-protocol-00.txt
http://www.crypto.ruhr-uni-bochum.de/adhocsec/PP_ZJH.pdf
http://people.cornell.edu/pages/pp59/Docs/mc2r.pdf
http://people.cornell.edu/pages/pp59/Docs/wise02.pdf
http://wnl.ece.cornell.edu/Publications/cnds02.pdf
or browse the WNL site: http://wnl.ece.cornell.edu for additional material.

Panos

----------------------------------------------------------------------------------------------------------
Panagiotis 
Papadimitratos               http://www.people.cornell.edu/pages/pp59
Wireless Networks Laboratory    http://wnl.ece.cornell.edu
School of Electrical 
Engineering
Cornell 
University 

374 Frank Rhodes Hall           Tel: +1-607-255-9068
Ithaca, NY 14853                        Fax: +1-607-255-9072
U.S.A                                   E-mail: [email-masked]
----------------------------------------------------------------------------------------------------------