Re: [apps-discuss] Review of draft-lear-lisp-nerd-08

[Dave Cridland <[e-mail]>]

I also had a quick skim.

What struck me was that, given the decision to use object-level  
security over transport-level, there seemed to be portions of  
information left unprotected.

For example, the protocol appears to rely on versioning information  
left unprotected, as well as HTTP-level redirects which also appear  
to be unprotected.

I wondered whether any interesting attack could be mounted by  
presenting older versions of the NERD as newer, meaning that the  
deltas were misinterpreted.

I'd think that the correct thing to do would be to include the  
versioning information within the PKCS#7, and also include expiry  
and/or next-update information, so that participating routers could  
flag up outdated information and alert operators, as well as be  
reasonably aware of when some form of quiet disruption was occuring.

That said, I freely admit that not only is this area not my forté to  
begin with, but I lack experience of LISP at all, so I won't be  
surprised if I'm missing something obvious.

Dave.
-- 
Dave Cridland - mailto:[e-mail] - xmpp:[e-mail]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade