Subject: [manet] Security consideration text regarding carrying multiple messages

From: "Ian Chakeres" <[email-masked]>
Date: Sat, 27 Oct 2007 18:32:37 +0530

I believe that since PacketBB is the container format built for
carrying multiple messages (possibly and likely from multiple
protocols) the security consideration section should discuss this
issue.

Independent of the location, I'd like to solicit suggestions on the
appropriate text.

Everyone, what would you suggest?

Ian Chakeres

Note: The current text in IANA-06 came from discussion with persons
from the security directorate.

On 10/27/07, Thomas Clausen <[email-masked]> wrote:
>
> On Oct 26, 2007, at 2:17 PM, Dearlove, Christopher (UK) wrote:
>
> >
> >> Please review the updated document ASAP and provide any comments.
> >
> > One minor nit, and one more significant comment.
> >
> > The minor nit is that the reference [I-D.ietf-manet-packetbb] is
> > two versions out of date.
> >
> > The significant comment is that this document says
> >
> >     The security issues associated with using the same UDP
> > port/multicast
> >     address/IP protocol number for multiple protocols are addressed in
> >     [I-D.ietf-manet-packetbb].
> >
> > No, it isn't, and neither should it be. The place for that discussion
> > is here, not in packetbb.
>
> I agree with Chris, that this discussion does not belong in packetbb,
> and I feel that draft-ietf-manet-iana should not suggest this.
> --
> Thomas Clausen
> [email-masked]
> http://www.lix.polytechnique.fr/Labo/Thomas.Clausen/
> http://www.lix.polytechnique.fr/hipercom/
>
>
>
>
>

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: "Ian Chakeres" <[email-masked]>
Date: Tue, 30 Oct 2007 09:34:39 +0530

How do you feel about the following text being placed in the security
considerations section of the IANA document?

"""
The security issues associated with operating multiple
cooperating MANET protocols on same IANA assignments (e.g. UDP
port) are addressed in each protocols' specification, as are
each protocols' particular security considerations.
"""

Please provide comments and suggestions.
Ian Chakeres

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 30 Oct 2007 09:55:32 +0100

> Please provide comments and suggestions.

If you're asking members on this group as well... I am not sure into how 
much depth do we want to discuss this...

One first wonders are those MANET protocols cooperating or competing? 
You're saying cooperating.  If they were truly cooperating I don't see 
any risk.

If they're competing is there a risk that two competing protocols 
compute different paths leading to a deadlocking deadend looping 
situation?  Is this a security risk?

What kind of security risk do you mean by "using same UDP 
port/mcastaddr/IPprotocolnumber associates security issues"?  I see some 
operational headaches (at least: tough to write a meaningful 
Ethereal/Wireshark dissector), but what are the security issues and risks?

Alex

>> Everyone, what would you suggest?

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

---

From: "Ian Chakeres" <[email-masked]>
Date: Tue, 30 Oct 2007 15:03:37 +0530

Comments inline.

> much depth do we want to discuss this...

I think we should try to stay within the context of what the
MANET-IANA document should say.

> situation?  Is this a security risk?

The general case will be one of cooperation. For example, NHDP with
DYMO or OLSRv2.

The competing issue you described would be associated with routing
protocols, not necessarily the IANA allocations or combined messaging.
The situation you described is no different from today's routing
suites where multiple routing protocols run simultaneously. Mechanisms
exist to handle this type of competition/redundancy.

> Ethereal/Wireshark dissector), but what are the security issues and risks?

DISCLAIMER: I'm not a security expert either. Therefore, I do not see
a big issue with our scenarios and the IANA allocations. That said, I
am doing my best to identify the possible security complications and
propose a solution.

Ian