Re: [babel] WG Last Call for draft-ietf-babel-dtls-03

well, I've been playing catchup on these drafts for a while and had
barely looked at this before now.

* As usual, I like having two interoperable implementations before
committing to a draft.

To me, this is unclear:

" When a Babel node
   discovers a new neighbor (generally by receiving an unencrypted
   multicast Babel packet), it compares the neighbour's IPv6 link-local
   address with its own, using network byte ordering.  If a node's
   address is lower than the recently discovered neighbor's address, it
   acts as a client and connects to the neighbor.  In other words, the
   node with the lowest address is the DTLS client for this pairwise
   relationship.  As an example, fe80::1:2 is considered lower than
   fe80::2:1."

A DTLS enabled node receiving that unencrypted multicast hello packet
(on the main babel port? on the dtls port?), is then supposed to try
contacting the other router on the DTLS port?

Recieving a hello from a lower numbered fe80 address means you wait
for the lower numbered fe80 address to initiate (so you send a hello
with or without an ihu?)

So a DOS attack is merely lots of hellos and a very slow DTLS
exchange? (what are the timeouts associated with a DTLS negotiation?)

In the HMAC draft there was a 300ms timeout suggested for some things.

On Wed, Jan 9, 2019 at 11:33 AM David Schinazi <dschinazi.ietf@gmail.com> wrote:
>
> (Stating the obvious, as co-author) I support publication.
>
> On Wed, Jan 9, 2019 at 10:30 AM Antonin Décimo <antonin.decimo@gmail.com> wrote:
>>
>> Hello Donald,
>>
>> I support publication.
>>
>> -- Antonin
>
> _______________________________________________
> babel mailing list
> babel@ietf.org
> https://www.ietf.org/mailman/listinfo/babel

--

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740