Subject: Re: [manet] Last Call: <draft-ietf-manet-nhdp-sec-threats-03.txt> (Security Threats for NHDP) to Informational RFC

From: Abdussalam Baryun <[email-masked]>
Date: Sun, 2 Jun 2013 06:48:26 +0200

Continue Reply to your request dated 24/05/2013
Draft Reviewed By: Abdussalam Baryun (AB)    Dated:02/06/2013
Reviewed I-D: draft-ietf-manet-nhdp-sec-threats-03
Reviewer Comment A2: Referencing the NHDP and related to RFC6130
++++++++++++++++++++++++++++++++++++++++++++++++++

I think if we got an effort in IETF to update NHDP [RFC6130] as draft
[1] does, why this reviewed I-D of threats does not include [1] in its
references to be reviewed before reviewing this NHDP-threat I-D? I
suggest to include draft [1] in References section, IMHO, any updates
to RFC6130 should be considered by the community while reviewing this
I-D.

[1] draft-ietf-manet-nhdp-olsrv2-sec-02

AB

> On 5/24/13, The IESG <[email-masked]> wrote:
>>
>> The IESG has received a request from the Mobile Ad-hoc Networks WG
>> (manet) to consider the following document:
>> - 'Security Threats for NHDP'
>>   <draft-ietf-manet-nhdp-sec-threats-03.txt> as Informational RFC
>>
>> The IESG plans to make a decision in the next few weeks, and solicits
>> final comments on this action. Please send substantive comments to the
>> [email-masked] mailing lists by 2013-06-06. Exceptionally, comments may be
>> sent to [email-masked] instead. In either case, please retain the
>> beginning of the Subject line to allow automated sorting.
>>
>> Abstract
>>
>>    This document analyses common security threats of the Neighborhood
>>    Discovery Protocol (NHDP), and describes their potential impacts on
>>    MANET routing protocols using NHDP.
>>
>> The file can be obtained via
>> http://datatracker.ietf.org/doc/draft-ietf-manet-nhdp-sec-threats/
>>
>> IESG discussion can be tracked via
>> http://datatracker.ietf.org/doc/draft-ietf-manet-nhdp-sec-threats/ballot/
>>
>>
>> No IPR declarations have been submitted directly on this I-D.
>> _______________________________________________
>> manet mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/manet
>>
>

---

From: "Adrian Farrel" <[email-masked]>
Date: Sun, 2 Jun 2013 16:51:47 +0100

Hi Abdussalam,

I think it is a reasonable suggestion for this I-D to make a forward reference
to draft-ietf-manet-nhdp-olsrv2-sec
Although this work is clearly scoped to NHDP (RFC 6130) as currently specified,
it is worth an informational reference to note that there is work in progress
that seeks to update NHDP to counter a number of security threats described in
this document.

I do not think, however, that this I-D should attempt to describe the situation
with NHDP after the inclusion of protocol work that has not yet been completed.
Contrary to your suggestion, I think this I-D motivates updates to 6130 and it
would be wrong to review this document in the context of changes being made to
address this document. 

Thanks,
Adrian

---

From: Abdussalam Baryun <[email-masked]>
Date: Sun, 2 Jun 2013 19:35:04 +0200

Hi Adrian

My comments below,

> that seeks to update NHDP to counter a number of security threats described

So I understand you agree with my suggestion on this I-D to
referencing/refering to that draft [1].

> with NHDP after the inclusion of protocol work that has not yet been

I think the work completes when the WG submits to AD, but reviews not
completed. IMHO, the draft/work [1] is completed from WGLC, and now is
at AD review.

> would be wrong to review this document in the context of changes being made

I suggest the I-D referencing. I do not think I suggested way of
reviews, but that other satetment was my opinion/beleive or advise to
community of such reveiw for output quality. I don't understand why
you think it was wrong way of review, after you agreed to reference
such document (usually my reviewing reviews all references as well).

Regards
AB

---

From: Ulrich Herberg <[email-masked]>
Date: Sun, 2 Jun 2013 22:35:57 -0700

Hi Adrian,

I personally agree that adding an informational ref to
draft-ietf-manet-nhdp-olsrv2-sec is a good idea. I will discuss with my
co-authors.

Thanks
Ulrich

---

From: Jiazi Yi <[email-masked]>
Date: Mon, 3 Jun 2013 11:08:20 +0200

Hi, 

I think it's OK to add an informative reference to draft-ietf-nhdp-olsrv2-sec, which serves as a pointer to the related work going on, and possible countermeasures to the threats. 

best

Jiazi

On Jun 3, 2013, at 07:35 , Ulrich Herberg <[email-masked]> wrote:

> Hi Adrian,
> 
> I personally agree that adding an informational ref to draft-ietf-manet-nhdp-olsrv2-sec is a good idea. I will discuss with my co-authors.
> 
> Thanks
> Ulrich
>

---

From: Abdussalam Baryun <[email-masked]>
Date: Mon, 3 Jun 2013 17:10:29 +0100

I would hope that IETF add my name in the acknowledgement section of the
I-D. I complained to AD about that my efforts in WGLC was not acknowledged
by editors even after my request, however, I did not stop reviewing (trying
not be discouraged) which I will complete on 6 June with the final
comments. Therefore, this message (can be added as a comment on the I-D) is
an objection to section 8 that ignores acknowledge input/review effort
related to the I-D.

AB

---

From: Abdussalam Baryun <[email-masked]>
Date: Thu, 6 Jun 2013 22:33:34 +0200

Reply to your request dated 24/05/2013
I-D: draft-ietf-manet-nhdp-sec-threats-03
Draft Reviewed By: Abdussalam Baryun (AB)    Dated:06/06/2013
Reviewer Comment A3: Use Cases not considered and the Information Bases Threats.
+++++++++++++++++++++++++++++++++++++++
*Use-cases threats*

Reading the RFC6130 applicability section 3, the I-D does not consider
all the use-cases included in the that section 3.

AB> Does the use-case of NHDP [RFC6130] add any value to the threats,
or the I-D assumes only one use case which is OLSRv2 network.

The NHDP uses RFC5444 packets and RFC5444 messages, so what are the
threats to NHDP use for each? not mentioned in I-D.

RFC6130> NHDP Can use relevant link-layer information if it is available.
AB> is there any threat from that use-case? not mentioned in the I-D.

*Information bases threats*

RFC6130> Appendix F> This appendix illustrates various examples of
physical topologies, as well as how these are logically recorded by
NHDP from the point of
view of the router A. This representation is a composite of
information that would be contained within A’s various Information
Bases after NHDP has been running for sufficiently long time for the
state to converge.

AB> Why the logically recording of the NHDP for all the examples not
mentioned in the I-D and were not threat analysed? If there is similar
level of threats related to all exampels in RFC6130, then please
mention that.

This is my last message, thanks.

Regards
AB

---

From: Ulrich Herberg <[email-masked]>
Date: Thu, 6 Jun 2013 13:52:43 -0700

AB,

while the IETF LC has already ended, I will reply to your comments below:

> Reviewer Comment A3: Use Cases not considered and the Information Bases Threats.

I don't understand the question. The use case is a MANET running NHDP.
Section 5 in addition outlines consequences of security threats to
NHDP for protocols using the information from NHDP.

> threats to NHDP use for each? not mentioned in I-D.

I don't understand the question. There is no danger from a message or
packet itself;  they may contain information that has either been
legitimately tampered with or that is "wrong" because of
misconfiguration. And these are the cases we have described.

> AB> is there any threat from that use-case? not mentioned in the I-D.

After discussion on the MANET mailing list, this was already added in
section 4.8 (even though the link quality itself is not a normative
part of RFC6130, the authors agreed to add that section).

> level of threats related to all exampels in RFC6130, then please

I don't understand the question. The example in RFC6130 simply
illustrates how NHDP would perceive and store several sample
topologies. How would that represent a "level of threat"? The I-D
describes several security threats and explains in which situations
these could occur (and what effect it would have). That could happen
in an infinite amount of different topologies, so it is impossible
(and useless) to list all topologies where such attacks could occur.

Best regards
Ulrich

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 6 Jun 2013 22:01:38 +0100

I find it somewhat disruptive that this email raises new questions on a draft
authored in a working group in which you participate, and that it has arrived
after the end of IETF last call.

I see a series of questions in this message, but no suggested textual changes. I
therefore conclude that you are requesting no changes and none shall be made. 

Thank you.
Adrian

---

From: Abdussalam Baryun <[email-masked]>
Date: Thu, 6 Jun 2013 23:48:50 +0200

I received an IESG message asking my comments so I gave it, regard to
your comments below, the reply is that I refer to missing information
needed in the I-D, so the reveiw suggests that there is something
missing. Did not suggested text because I know that it most probably
not be considered.

The Last call ends by 06.06.2013 so I still am in this date, not sure
why you close,

AB

---

From: Ulrich Herberg <[email-masked]>
Date: Mon, 10 Jun 2013 13:34:01 -0700

We have submitted a new revision of the draft, addressing one comment
from Adrian during IETF LC (which we wanted to address in the previous
revision, but forgot about it). We added a new section that can
trigger future work, as requested by Adrian.

To the WG: Obviously, the new text is up for discussion if anyone has
any issues with it.

Best regards
Ulrich

---

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 11 Jun 2013 10:57:03 +0200

The IETF Last Call has finished after 06.06.13 and now you request
discussions. I think only IESG can call for discussions not editors.

> trigger future work, as requested by Adrian.

I don't see that Adrian requested a future work section, could you
refer to his input for that or was that private request. May be
comments in last call made you think to add missing information as
future. What is the reason for future work in this informational
draft?
> To the WG: Obviously, the new text is up for discussion if anyone has

Is that a new text or new idea? if I don't know what the Editors
discussed privately (outside IETF) how can I discuss inside IETF?
However, I will not review any more for this draft because it has
special policy for refering to contributions.

AB

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 11 Jun 2013 10:59:37 +0100

> future. What is the reason for future work in this informational

Abdussalam,

Look and ye shall see. Seek and ye shall find. 

http://www.ietf.org/mail-archive/web/manet/current/msg15423.html
> 2. Please consider adding a short section that may drive new work by
>   suggesting which threats need to be addressed in new protocol work,
>   which in deployment, and which by applications.

Adrian