Subject: [manet] Security question for draft-ietf-manet-aodvv2-04

From: Thomas Clausen <[email-masked]>
Date: Tue, 22 Jul 2014 10:25:07 -0400

Given that  we were told that a way forward for security had been identified, but we were not allowed to know what that way forward was,  I'll  ask some specific questions that I hope can be answered.

Page numbers refer to the document in <subject>

--- Page 4 ---

Draft text:
> When a data packet is received to  be forwarded but there is no valid route for the destination, 
> then  the AODVv2 router of the source of the packet is notified via a Route  Error (RERR) 
> message.

Comment:
This, then, essentially, means that for every non-routable packet, the protocol must be informed -- as for with routing table "hits" for marking a route as active, this is uncommon, and somewhat intrusive, as has been discussed elsewhere. 

Question:
With that being said, as a router must send a message for each non-delivered message, this also does sound like a formidable attack vector against a router: pump it data packets to a set of non-existing address, and watch it exhaust itself generating RERRs.
How is that being guarded against?

Draft text:
> Each upstream router that receives the RERR  marks the route as broken.

Comment:
So, essentially this implies that it is possible to do a denial-of-service attack, by injecting RERRs and cause other devices to do a RREQ flooding on the network -- draining battery, causing channel congestion, etc.

Question:
How is this protected against?

Bigger Question:
It is possible to attack a router, and the network *both* by sending control signals and by sending data packets. 

One might device an "admission policy" based in ICVs on control signals, that could be used to exclude (as in the above) a rogue RERR.

How to protect against attacks-by-data-packets? Requiring ICVs on all data packets seems unfeasible, what's the "way forward" for this?

Best,

Thomas

Sent from my iPad