Subject: [manet] I-D Action: draft-ietf-manet-nhdp-sec-02.txt

From: [email-masked]
Date: Tue, 29 May 2012 17:04:25 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Mobile Ad-hoc Networks Working Group of the IETF.

	Title           : Using Integrity Check Values and Timestamps For Router Admittance in NHDP
	Author(s)       : Ulrich Herberg
                          Thomas Heide Clausen
	Filename        : draft-ietf-manet-nhdp-sec-02.txt
	Pages           : 12
	Date            : 2012-05-29

   This document specifies a security extension to the MANET
   Neighborhood Discovery Protocol (NHDP).  The extension introduces the
   use of Integrity Check Values (ICVs) and Timestamps in HELLO messages
   in order to provide a router admittance mechanism, and therefore to
   counter a selection of security threats to NHDP.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-manet-nhdp-sec-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-manet-nhdp-sec-02.txt

The IETF datatracker page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-manet-nhdp-sec/

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Wed, 30 May 2012 13:06:29 +0000

-- 
Christopher Dearlove
Senior Principal Engineer, Communications Group
Communications, Networks and Image Analysis Capability
BAE Systems Advanced Technology Centre
West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
Tel: +44 1245 242194 |  Fax: +44 1245 242124
[email-masked] | http://www.baesystems.com

BAE Systems (Operations) Limited
Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre, Farnborough, Hants, GU14 6YU, UK
Registered in England & Wales No: 1996687

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: 30 May 2012 01:04
To: [email-masked]
Cc: [email-masked]
Subject: [manet] I-D Action: draft-ietf-manet-nhdp-sec-02.txt
As I read it, this draft is proposing using the RFC 6622 mechanism to sign HELLO messages. RFC 6622 actually allows for signing packets as well as signing messages (both, either, or neither to be used as required). There isn't a major difference when considering HELLO messages, as few if any packets will contain more than one HELLO message, and the packet and the message will be signed by the same party.

However NHDP doesn't exist in a vacuum, in particular it is used by OLSRv2. Any security mechanism that is described in what will be an RFC for NHDP must also be what's right for NHDP as used by OLSRv2. OLSRv2 also has TC messages to consider, and they don't satisfy the points noted above (on number or on who signs them). And one option for OLSRv2 is to sign all packets, not messages. This can be a sensible decision there, for several reasons, in some real circumstances.

Consequently, I don't believe that this draft should describe only signing HELLO messages as the correct thing to do, that it should also allow signing packets as an equal status option. If someone wants to raise the possibility of signing (possibly by methods with different properties) both at the message and packet level, that may have its use cases too.

Incidentally, even within the limited framework of just NHDP, it is possible that packets need protection. If an NHDP implementation chooses to use packet sequence number as part of its link quality mechanism, as it may, then an unprotected packet header is a vulnerability.

(For the sake of completeness, RFC 6622 also allows address block signatures. I don't have a reason to suggest using this within NHDP or OLSRv2.)

----------------------! WARNING ! ----------------------
This message originates from outside our organisation,
either from an external partner or from the internet.
Keep this in mind if you answer this message.
Follow the 'Report Suspicious Emails' link on IT matters
for instructions on reporting suspicious email messages.
--------------------------------------------------------

_______________________________________________
manet mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/manet

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Wed, 30 May 2012 13:21:46 +0000

(Sending again, to sort out the formatting problem with the last attempt.)