Re: [Anima-signaling] Concern about GRASP Flood message

[Toerless Eckert <[e-mail]>]

If we had in the future ASA that can come from different vendors,
eg: lightblub ASAs from two different lightning system vendors,
and they want to trust objectives from other ASAs of the same vendor
differently than those from other vendors, then it would certainly
become interesting to have per-objective authentication. Would be an
interesting GRASP CBOR layer question if you want to take the relevant
part of the objective/synchronization payload and create a signature
for the CBOR representation of that and then add that signature to the CBOR message.

Alas, this is a long way off. We'd first need to have models
for per-ASA keying material. Like at least eg: certificates for apps like
android/iOS stores have them. and then expand from there.

On Thu, Jul 21, 2016 at 07:31:19PM +1200, Brian E Carpenter wrote:
> On 21/07/2016 19:03, Carsten Bormann wrote:
> > Is there going to be any security?
> > Or is a flood message authenticated by the group key protecting the ASA?
> 
> No, it will be implicitly authenticated by arriving via the ACP.
> (Unless used in a insecure instance of GRASP, but I don't think we will
> want that.)
> 
> > If there is data origin authentication, this already provides a source.
> 
> Right, we had that sort of approach in the old TLV version of the protocol,
> but removed it when the ACP came along.
> 
> Regards
>   Brian
> 
> > 
> > Grüße, Carsten
> > 
> > 
> > Brian E Carpenter wrote:
> >> During various discussions this week, I decided there is an issue to decide
> >> around the GRASP Flood message.
> >>
> >> As it's currently defined, the node/ASA that receives a flooded objective
> >> doesn't know where it came from; the flood relaying mechanism simply
> >> loses the original source locator.
> >>
> >> Is this a problem? Does the recipient of a flooded objective sometimes
> >> need to know the source?
> >>
> >> If so, we'd have to add a field to the Flood message. For example, we could
> >> allow it to carry a Locator option.
> >>
> >> BTW, flooded objectives have no lifetime - they are valid until overwritten
> >> by a subsequent Flood message.
> >>
> >> Comments?
> >>
> > 
> 
> _______________________________________________
> Anima-signaling mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/anima-signaling

-- 
---
Toerless Eckert, [e-mail]