Subject: [Roll] Roman Danyliw's No Objection on draft-ietf-roll-turnon-rfc8138-14: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 09 Sep 2020 07:51:50 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-roll-turnon-rfc8138-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-roll-turnon-rfc8138/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Section 5.  Typo. s/an homogenous/a homogeneous/

Section 7.  Editorial. To be clearer on where the attacker is in the topology
and on who is incurring the cost:

OLD
An attacker in the middle of the network may reset the "T" flag to cause extra
energy spending in its subDAG.

NEW
An on-path attacker may reset the “T” flag to force additional energy
consumption by the nodes in the subDAG.

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 9 Sep 2020 15:24:45 +0000

Hello Roman

Many thanks for your time on this review, and for your comments below : )

Fixed

> 
> Section 7.  Editorial. To be clearer on where the attacker is in the topology and
> on who is incurring the cost:
> 
> OLD

Hum, I believe we're not there yet, because worded as this it looks like the attacker is along a unicast path. This is not the case.

The "T" flag is in a message (the DIO) that is propagated in a fashion that is akin to multicast though it's not. The RPL node receives DIO messages from neighbors that are willing to be parents. If this node decides to also be a parent, it will regenerate a DIO that contains some fields unchanged, including the DODAG configuration option. 

In that process, the bad guy may change some fields it shouldn't, including the "T" flag, but it's just one of many fields in that same situation. His children and their descendant will repeat that wrong setting. Note that this is not a tree but a DODAG. So you get DIOs from not one (candidate) parent but multiple ones. A descendant may discover an inconsistency between its parents (if some descend from the attacker and others do not) and could raise an alert, but the case can be normal, e.g., during a transition. RPL does not really specify that, it is left to implementations, e.g., constrained nodes will not spend code looking for anomalies.

Bottom line, there is no path to be on. There's a wave coming, the attacker relays that wave, and modifies it. If it is in the middle of the network this has an effect - on its descendants. If the attacker is at the leaf edge, the attack as no effect since this node has no descendant. 

What do you think?

Take care,

Pascal

---

From: Roman Danyliw <[email-masked]>
Date: Thu, 10 Sep 2020 11:57:31 +0000

Hi Pascal!

> -----Original Message-----
> From: Pascal Thubert (pthubert) <[email-masked]>
> Sent: Wednesday, September 9, 2020 11:25 AM
> To: Roman Danyliw <[email-masked]>; The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked]; [email-masked];
> Ines Robles <[email-masked]>; [email-masked]
> Subject: RE: Roman Danyliw's No Objection on draft-ietf-roll-turnon-rfc8138-
> 14: (with COMMENT)
> 
> Hello Roman
> 
> > Section 7.  Editorial. To be clearer on where the attacker is in the
> > topology and on who is incurring the cost:
> >
> > OLD
> > An attacker in the middle of the network may reset the "T" flag to
> > cause extra energy spending in its subDAG.
> >
> > NEW
> Hum, I believe we're not there yet, because worded as this it looks like the
> attacker is along a unicast path. This is not the case.
> 
> The "T" flag is in a message (the DIO) that is propagated in a fashion that is
> akin to multicast though it's not. The RPL node receives DIO messages from
> neighbors that are willing to be parents. If this node decides to also be a
> parent, it will regenerate a DIO that contains some fields unchanged, including
> the DODAG configuration option.
> 
> In that process, the bad guy may change some fields it shouldn't, including the
> "T" flag, but it's just one of many fields in that same situation. His children and
> their descendant will repeat that wrong setting. Note that this is not a tree but
> a DODAG. So you get DIOs from not one (candidate) parent but multiple ones.
> A descendant may discover an inconsistency between its parents (if some
> descend from the attacker and others do not) and could raise an alert, but the
> case can be normal, e.g., during a transition. RPL does not really specify that, it
> is left to implementations, e.g., constrained nodes will not spend code looking
> for anomalies.
> 
> Bottom line, there is no path to be on. There's a wave coming, the attacker
> relays that wave, and modifies it. If it is in the middle of the network this has
> an effect - on its descendants. If the attacker is at the leaf edge, the attack as
> no effect since this node has no descendant.
> 
> What do you think?

Understood.  I now appreciate the vagueness of the original words.  I'm trying to find an alternative to using "middle of the network" since this doesn't convey for me the hierarchy you are describing.  See below:

> > OLD
> > An attacker in the middle of the network may reset the "T" flag to
> > cause extra energy spending in its subDAG.

NEW
An attacker may reset the "T" flag to force additional energy consumption of child or descendant nodes in its subDAG.

Regards,
Roman

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 10 Sep 2020 12:30:48 +0000

Hello Roman 😊

> > The "T" flag is in a message (the DIO) that is propagated in a fashion
> > that is akin to multicast though it's not. The RPL node receives DIO
> > messages from neighbors that are willing to be parents. If this node
> > decides to also be a parent, it will regenerate a DIO that contains
> > some fields unchanged, including the DODAG configuration option.
> >
> > In that process, the bad guy may change some fields it shouldn't,
> > including the "T" flag, but it's just one of many fields in that same
> > situation. His children and their descendant will repeat that wrong
> > setting. Note that this is not a tree but a DODAG. So you get DIOs from not
> one (candidate) parent but multiple ones.
> > A descendant may discover an inconsistency between its parents (if
> > some descend from the attacker and others do not) and could raise an
> > alert, but the case can be normal, e.g., during a transition. RPL does
> > not really specify that, it is left to implementations, e.g.,
> > constrained nodes will not spend code looking for anomalies.
> >
> > Bottom line, there is no path to be on. There's a wave coming, the
> > attacker relays that wave, and modifies it. If it is in the middle of
> > the network this has an effect - on its descendants. If the attacker
> > is at the leaf edge, the attack as no effect since this node has no descendant.
> >
> > What do you think?
> 
> Understood.  I now appreciate the vagueness of the original words.  I'm trying
> to find an alternative to using "middle of the network" since this doesn't
> convey for me the hierarchy you are describing.  See below:
> 
> > > OLD

I love it, Roman!

I'll be holding the publication till Alvaro and Benjamin reach an agreement on whether this updates RFC 6550 or not.

Till then I committed the diffs as  https://github.com/roll-wg/roll-turnon-rfc8138/commit/80fa3425e8c0c60a8482ddb2583f75f405fe490a

Please let me know if we are good now.

Take care,

Pascal

---

From: Roman Danyliw <[email-masked]>
Date: Thu, 10 Sep 2020 12:42:12 +0000

Hi Pascal!

> Sent: Thursday, September 10, 2020 8:31 AM
> > > The "T" flag is in a message (the DIO) that is propagated in a
> > > fashion that is akin to multicast though it's not. The RPL node
> > > receives DIO messages from neighbors that are willing to be parents.
> > > If this node decides to also be a parent, it will regenerate a DIO
> > > that contains some fields unchanged, including the DODAG configuration
> option.
> > >
> > > including the "T" flag, but it's just one of many fields in that
> > > same situation. His children and their descendant will repeat that
> > > wrong setting. Note that this is not a tree but a DODAG. So you get
> > > DIOs from not
> > > alert, but the case can be normal, e.g., during a transition. RPL
> > > does not really specify that, it is left to implementations, e.g.,
> > > attacker relays that wave, and modifies it. If it is in the middle
> > > of the network this has an effect - on its descendants. If the
> > > attacker is at the leaf edge, the attack as no effect since this node has no
> descendant.
> > >
> > > What do you think?
> >
> > Understood.  I now appreciate the vagueness of the original words.
> > I'm trying to find an alternative to using "middle of the network"
> > since this doesn't convey for me the hierarchy you are describing.  See below:
> >
> > > > OLD
> > An attacker may reset the "T" flag to force additional energy
> > consumption of child or descendant nodes in its subDAG.
> >
> > Regards,
> 
> I love it, Roman!
> 
> Till then I committed the diffs as  https://github.com/roll-wg/roll-turnon-
> rfc8138/commit/80fa3425e8c0c60a8482ddb2583f75f405fe490a
> 

Looks good to me!  Thanks for the quick turnaround.

Regards,
Roman