Re: [Anima-signaling] Concern about GRASP Flood message

[Brian E Carpenter <[e-mail]>]

On 21/07/2016 19:51, Toerless Eckert wrote:
> If we had in the future ASA that can come from different vendors,
> eg: lightblub ASAs from two different lightning system vendors,
> and they want to trust objectives from other ASAs of the same vendor
> differently than those from other vendors, then it would certainly
> become interesting to have per-objective authentication. Would be an
> interesting GRASP CBOR layer question if you want to take the relevant
> part of the objective/synchronization payload and create a signature
> for the CBOR representation of that and then add that signature to the CBOR message.
> 
> Alas, this is a long way off. We'd first need to have models
> for per-ASA keying material. Like at least eg: certificates for apps like
> android/iOS stores have them. and then expand from there.

Right. But adding a signature option to all or some GRASP messages
is a backwards-compatible extension we could introduce later. Adding it
at the CBOR level might be a bit more tricky.

For now, I think the requirement to identify the source of a Flood message
is a more urgent question. There is already one use case emerging: using Flood
to announce bootstrap Registrars to all bootstrap Proxies. A proxy needs to
be able to choose which registrar to use, so needs to distinguish them by
source locator.

    Brian

> On Thu, Jul 21, 2016 at 07:31:19PM +1200, Brian E Carpenter wrote:
>> On 21/07/2016 19:03, Carsten Bormann wrote:
>>> Is there going to be any security?
>>> Or is a flood message authenticated by the group key protecting the ASA?
>>
>> No, it will be implicitly authenticated by arriving via the ACP.
>> (Unless used in a insecure instance of GRASP, but I don't think we will
>> want that.)
>>
>>> If there is data origin authentication, this already provides a source.
>>
>> Right, we had that sort of approach in the old TLV version of the protocol,
>> but removed it when the ACP came along.
>>
>> Regards
>>   Brian
>>
>>>
>>> Grüße, Carsten
>>>
>>>
>>> Brian E Carpenter wrote:
>>>> During various discussions this week, I decided there is an issue to decide
>>>> around the GRASP Flood message.
>>>>
>>>> As it's currently defined, the node/ASA that receives a flooded objective
>>>> doesn't know where it came from; the flood relaying mechanism simply
>>>> loses the original source locator.
>>>>
>>>> Is this a problem? Does the recipient of a flooded objective sometimes
>>>> need to know the source?
>>>>
>>>> If so, we'd have to add a field to the Flood message. For example, we could
>>>> allow it to carry a Locator option.
>>>>
>>>> BTW, flooded objectives have no lifetime - they are valid until overwritten
>>>> by a subsequent Flood message.
>>>>
>>>> Comments?
>>>>
>>>
>>
>> _______________________________________________
>> Anima-signaling mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/anima-signaling
>