Re: [dtn-interest] Comments on RFC 5050

[Amy Alford <[e-mail]>]

>  4.7. Dictionary Revision:
>> "Any [unreferenced] strings (scheme names and SSPs) in a bundle's
>> dictionary ... may be removed from the
>>      dictionary at the time the bundle is forwarded."
>> ...subject to that authenticity is not lost.
>>
>>   * Yes, but that’s implicit.  Strings that are needed in order to
>>
>>     verify authenticity are referenced, so they can’t be removed from
>>     the dictionary.
>>
>
> Could it happen that some extension block be processed, removed and its
> EID references removed by some intermediate node on a security path? I am
> still trying to figure out what is possible with the current security spec.
>
Yes.  Talking through a specific example is probably the best way to
clarify this.  Suppose we have a very boring network of:

Node A --- Node B --- Node C --- Node D

Node A sends a bundle to node D, with a PIB block with security source of
node A and security destination of node D.  Node B can add a PIB block with
security source node B and security destination node C.  When node C
removes the PIB block destined for node C, it may change the dictionary.
 But, it would change it back to its state at the time the first PIB was
calculated.

In any event, PIBs don't cover the dictionary (only the specific entries
being used in the blocks covered by the PIB).  BABs cover the dictionary,
but are always the last security block added and first removed.  The only
time dictionary changes would invalidate a BAB are if the dictionary was
modified at a non security aware node.  However, if the dictionary was
being modified because of a change to an extension block, that would
invalidate the BAB anyway.  The only dictionary changes that would
invalidate a PIB are gratuitous changes to case insensitive fields.

- Amy