Re: [babel] rtgdir Last Call Review requested: draft-ietf-babel-dtls

[Juliusz Chroboczek <[e-mail]>]

>     I wonder if using DTLS protected unicast Hellos should be mandatory...
>     using unprotected multicast to determine bidirectional reachability
>     looks like a good way to do a cheap denial of service attack.

> In Babel, bidirectional reachability is established using both Hellos and IHUs.
> We explicitly require DTLS protection for IHUs to prevent an attacker
> from tricking you into thinking you have bidirectional reachability.
> This reduces the protocol's attack surface by limiting what an attacker can do.

I think David's answer is clear, but I'll insist some more, since this is
an important point (and we got it wrong in an earlier draft).

In Babel, the equivalent of an OSPF Hello is a pair of Hello (establishes
reverse reachability) and IHU (establishes direct reachability).
Bidirectional reachability is only established after a successful
Hello/IHU exchange.

In cleartext Babel, both Hellos and IHUs can be sent over either multicast
or unicast.  In DTLS-protected Babel, Hellos can be sent over either
(unprotected) multicast or (protected) unicast, while IHUs can only be
sent over (protected) unicast and are silently ignored if sent over multicast.

Hence, bidirectional reachability requires a protected IHU to be received.

-- Juliusz