Subject: [homenet] Fwd: I-D Action: draft-lemon-homenet-babel-security-latest-00.txt

From: Ted Lemon <[email-masked]>
Date: Wed, 25 Oct 2017 13:35:48 -0400

Oops, given that Juliusz is asking questions about security considerations, it might be worth sharing this.   This isn't just my work, but for reasons having to do with available time, the other names will have to be added later.

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: I-D Action: draft-lemon-homenet-babel-security-latest-00.txt
> Date: October 23, 2017 at 12:06:39 PM EDT
> To: <[email-masked]>
> Reply-To: [email-masked]
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
>        Title           : Babel Security Model
>        Author          : Ted Lemon
> 	Filename        : draft-lemon-homenet-babel-security-latest-00.txt
> 	Pages           : 6
> 	Date            : 2017-10-23
> 
> Abstract:
>   This document describes how to add authenticity to Babel messages so
>   as to prevent malicious tampering or black hole attacks.  Peer trust
>   is outside the scope of this document.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-lemon-homenet-babel-security-latest/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-lemon-homenet-babel-security-latest-00
> https://datatracker.ietf.org/doc/html/draft-lemon-homenet-babel-security-latest-00
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 25 Oct 2017 21:06:28 +0200

[Added babel@ietf to CC.]

Thanks, Ted.

> https://datatracker.ietf.org/doc/draft-lemon-homenet-babel-security-latest/

I'm not a security specialist, so just a few comments:

1.  You're using a TLV, which means that the TLV parser runs before auth.
Is this good practice?  What about using the packet trailer ?

2. A number of security mechanisms are being considered for Babel.
There's Denis' RFC 7557, which you're aware of.  The other technique that
we're working on is the use of DTLS.  See point 3.

3. The main improvement of RFC6126bis over 6126 is the ability to run Babel
over unicast with no multicast except for discovery (and no multicast at
all if discovery is done out of band).  This makes it possible to use DTLS
and/or dynamically keyed IPsec to secure Babel.  At least some of the
participants of the Babel WG are in favour of such an approach.

4. It is my understanding that there is consensus in the Babel WG that we
don't adopt before there is an implementation.  That's not to diminish
your input, just the statement of an (IMHO happy) state of affairs.

Dinnertime for me.  Be hearing from you later.

-- Juliusz

---

From: Ted Lemon <[email-masked]>
Date: Wed, 25 Oct 2017 15:12:07 -0400

> Is this good practice?  What about using the packet trailer ?

If you aren't using a shotgun parser, it shouldn't matter.

> participants of the Babel WG are in favour of such an approach.

Yup.   DTLS is just convenient—it means that it's not necessary to re-invent the wheel.

> your input, just the statement of an (IMHO happy) state of affairs.

That makes perfect sense to me.   I don't think the DTLS implementation would be that hard—is there any chance that anyone would be interested in working on this during the hackathon in Singapore?   I say "anyone" because I don't want to put you on the spot.

---

From: Juliusz Chroboczek <[email-masked]>
Date: Thu, 26 Oct 2017 00:04:07 +0200

> That makes perfect sense to me. I don't think the DTLS implementation would be
> that hard—is there any chance that anyone would be interested in working on
> this during the hackathon in Singapore?

A student of mine (Antonin, whom you might remember from Berlin) has been
working on that.  Unfortunately, it turned out a little bit more difficult
than expected, and so he ran out of summer.

He'll come back to it, I believe, but certainly not before the January
exam session is over.

-- Juliusz