[Anima-signaling] GRASP and BRSKI

[Brian E Carpenter <[e-mail]>]

(apologies for any duplicates)

I've been playing around to verify that GRASP as currently
defined can support the secure bootstrap discovery requirements
(i.e. proxy discovering registrars, and joining node (pledge)
discovering proxies).

I think we agreed that a registrar should broadcast its presence
(by flooding out its coordinates across the AN), so that's
what I modelled.

Toerless wanted to emulate the priority/weight parameters
available in mDNS and to know the distance (hop count) to each
registrar. I included that; it would be easy to remove.

There seemed to be some lack of consensus about whether pledges
should broadcast their presence (by sending a link-local discovery
multicast) or whether the proxy should broadcast *its* presence
(by flooding out its coordinates on-link). I modelled both methods.
The bootstrap team does need to choose.

Pledge broadcasts:
- pledge has to do two steps [discover() and synchronize()]
instead of one [get_flood()].
- on-link attacker knows that the pledge exists and (knowing its
address) might be able to intercept its subsequent unicast BRSKI
messages if promiscuous mode is possible.
- nothing stops an attacker from discovering the proxy by acting
like a pledge and then attacking it directly.

Proxy broadcasts:
- on-link attacker will not be told that a pledge exists (but might
still be able to intercept its unicast BRSKI messages if promiscuous
mode is possible).
- nothing stops an attacker from attacking the proxy directly.

Running code, of a sort, is at
https://www.cs.auckland.ac.nz/~brian/graspy/brski/

Please start with the README file.

Regards
   Brian