Subject: Re: [manet] AB#2 Comments for WGLC draft-ietf-manet-nhdp-sec-threats-02

From: Abdussalam Baryun <[email-masked]>
Date: Mon, 27 May 2013 16:05:07 +0200

On 4/9/13, Jiazi Yi <[email-masked]> wrote:
> Hi,
>
> On Apr 9, 2013, at 5:47 AM, Abdussalam Baryun
>> AB> Does attacks on IP layer increase threats to NHDP? Not understood from
>> I-D.
>> AB> Does attacks on MAC, L2 or L2.5 increase threats to L3-NHDP?
>> Does/Can NHDP possible depend on the lower layers, if yes, what are
>> the threats? Please note that these issues mentioned in RFC6130 but
>> not in this I-D.
>> ----------------------
>
> We don't even know what L2 L2.5 will be used with NHDP, so it's impossible
> to have further discussions on it.

Please read the AD review, regarding IP.
http://www.ietf.org/mail-archive/web/manet/current/msg15423.html

>
>>
>> [The use of NHDP]
>>
>> AB> If there is an attack on NHDP does that mostly mean that its users
>> are attacked as well?
>
> The consequence of the attacks has been introduced in the ID.
>
>> AB> In AODVv2 mentions that NHDP used to monitor and assure
>> bi-directional links, does that use have threats, why not mentioned,
>> please do.
>
> No. AODVv2 has no normative reference to NHDP.

Please read the AD review, regarding new work,
http://www.ietf.org/mail-archive/web/manet/current/msg15423.html

AB

---

From: "Adrian Farrel" <[email-masked]>
Date: Mon, 27 May 2013 15:27:19 +0100

In line.
Adrian

> http://www.ietf.org/mail-archive/web/manet/current/msg15423.html

I don't see anything in my review that relates to this issue.
I said...

| The assumption stated in the Introduction...
|    This document is based on the assumption that no additional security
|    mechanism (such as IPsec) is used in the IP layer.
| ...is perfectly fine. You might add a note to explain why this is a 
| reasonable assumption (i.e., it is particularly hard to configure
| security associations in this type of network) and you might also add a
| note about whether none, some, or all of the threats would go away if
| this problem could be resolved.

...and I can't even begin to associate the two comments.

> http://www.ietf.org/mail-archive/web/manet/current/msg15423.html

My review does not say and should not be interpreted as saying that the authors
need to look at the implications of NHDP security on AODVv2 or, indeed, on any
other protocol that does have a normative dependency on NHDP.

I wrote:

| 2. Please consider adding a short section that may drive new work by
|   suggesting which threats need to be addressed in new protocol work,
|   which in deployment, and which by applications.

This paragraph applies solely and entirely to NHDP.

For the avoidance of doubt, it may be read as:

2. Please consider adding a short section that may drive new NHDP
   work by suggesting which threats identified in this document need
   to be addressed in extensions or modifications to NHDP, which in
   deployment of NHDP, and which by applications that use NHDP.

For the further avoidance of confusion, I would not expect this document to
attempt to address the security concerns of other protocols (i.e. applications
that use NHDP). I would expect protocol specifications to identify and describe
their own security concerns so that, for example, the AODVv2 spec might
highlight the risks of false adjacencies that might arise from attacks on NHDP:
it would then refer to this document for a description of how that might happen;
to the NHDP spec and any protocol extension documents for a description of how
NHDP might be secured; and might go on to define its own security mechanisms (in
the application protocol) to protect the application protocol.

Adrian