Subject: Re: [6lo] Secure 6LoWPAN ND

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Fri, 20 Jun 2014 11:25:14 +0000

HI Behcet:

Interesting work, certainly worth pursuing IMHO.

I agree with your position that:
"
An LSEND for LLN node MUST set the Owner
   Interface Identifier field (EUI-64) in ARO to the rightmost 64 bits
   of its crypotographically generated address.
"

This makes a lot of sense and binds the registered address to the CGA-based OII.
Note that since the packets carry the OII, we do not need the source address to match that CGA anymore. 
So I disagree with:

"
   6LBR receives the address registration NS. 6LBR then verifies the
   source address as described in Section 5.1.2. of [RFC3971] using the
   claimed source address and CGA Parameters field in the message.
"

LSeND will by us that all the signed message with that OII come from a same party. 
Then, if that party if the first to claim any address it likes, then it becomes owner of that address and the address is bound to the CGA in the 6LR registry.
The idea is that we do not want the constrained device to compute multiple keys for multiple addresses. 
The registration process allows us to tie all the addresses to a same OII and have the 6LR/6LBR enforce first come first serve after that.
Would you agree?

The next problem is the DAR/DAC message. Seems to me that the content that the source signs and the signature needs to be propagated to the 6LBR.
Again do you agree?

On the side, I'm trying to get Efficient ND and 6LoWPAN ND to register the target of the message as opposed to the source (http://tools.ietf.org/html/draft-thubert-6lo-rfc6775-update-reqs-01). Unsure I'll get somewhere with that but if so, it makes sense to indicate "the registered address" as opposed to "the source address".

Cheers,

Pascal

> -----Original Message-----
> From: 6lo [mailto:[email-masked]] On Behalf Of Behcet Sarikaya
> Sent: lundi 19 mai 2014 21:31
> To: [email-masked]
> Subject: [6lo] Secure 6LoWPAN ND
> 
>  Hi all,
> 
> I have  a draft on securing RFC 6775 using a form of SeND, the draft is at:
> 
> http://www.ietf.org/id/draft-sarikaya-ace-cga-nd-00.txt
> 
> Ulrich and Samita told me that such issues are in scope with 6lo.
> 
> 
> I'll appreciate your comments on this draft.
> 
> Regards,
> 
> Behcet
> 
> _______________________________________________
> 6lo mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/6lo

---

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 23 Jun 2014 15:59:26 -0500

Hi Pascal,

Thanks for your comments.
I think I agree with your first point.
I had trouble parsing the other points, I think you inadvertently
mistyped a few words. If you can clarify your points, that will be
helpful.

Regards,

Behcet