Re: [dtn] BPSEC Request: Removal of BAB blocks

Dear Ed,
     I have a comment on the first point, which also applies to the new draft. 
On a DTN node, the bundle layer usually operates on top of Transport, which is on top of Network, which is on top of Data link which is on top of Physical; two consecutive DTN nodes (e.g. A and B)  along the path from DTN source to destination identifies one DTN hop. Between A and B you can either have, or not, a number of non-DTN nodes, such as (non-DTN) IP routers. In the former case, which I suppose will be the norm in terrestrial or mixed terrestrial-space applications, you will have, on one single DTN hop, a chain of consecutive links, where one link is by definition between two consecutive IP routers.  
This is to say that one link does not generally coincides with one DTN hop, although it may happen. 
This could impairs the application of method 1.  If you use IP-sec in tunnel mode between consecutive gateways, you could have multiple IP-sec segments on one DTN hop, or just a partial coverage. For example, if you have a GEO sat  link in the middle of your DTN hop, you could have IP-sec in tunnel mode between the two gateway PEPs, and no IP-sec coverage outside (on the basis that the sat channel is more exposed to attacks than the terrestrial part). 
It seems simpler to apply security at the convergence layer instead, as one DTN hop is usually Transport-to-Transport. In this case, a possible disadvantage is that one node can be connected to other DTN nodes by a variety of different Convergence layers (A with B via LTP, A with C via TCP, and so on). In the case of BAB you need just one key per node, if I am not wrong, while at the convergence layer likely one key for each protocol (I suppose but I am not sure at all).
I have no objections on method 2 and 3 because in both cases they use mechanisms at Bundle layer, which I deem more appropriate dealing with bundle layer security.

I am not a real expert of this topic, so I could likely be wrong. My comments are just an attempt to better understand the problem.

Yours,
   Carlo

________________________________________
Da: dtn [dtn-bounces@ietf.org] per conto di Birrane, Edward J. [Edward.Birrane@jhuapl.edu]
Inviato: giovedì 21 gennaio 2016 21.39
A: dtn@ietf.org
Oggetto: [dtn] BPSEC Request: Removal of BAB blocks

All,

  At the January telecom, we agreed that BAB blocks can removed from the BPSEC specification and that hop-by-hop authentication can be achieved in (at least) 1 of 3 alternate ways:

1. Rely on lower link layers to provide hop-by-hop authentication
2. Integrity sign with a BIB an ephemeral block between two BPAs, such as the Prior Hop Notification (PHN) block.
3. Design some other user/application related block to contain a hash of some canonical form of the bundle and sign that.

These mechanisms are captured in a draft "security practices" document published as https://tools.ietf.org/html/draft-birrane-dtn-sec-practices-00  in section 4.6 "Hop by Hop Authentication".

ACTION:

Please comment if there is an issue with removing BABs from the BPSEC specification. We can create a new thread to discuss the security practices and whether the alternate mechanisms listed above are the correct ones or if we need others.

-Ed

---
Edward J. Birrane, III, Ph.D.
Embedded Applications Group Supervisor
Space Exploration Sector
Johns Hopkins Applied Physics Laboratory
(W) 443-778-7423 / (F) 443-228-3839

_______________________________________________
dtn mailing list
dtn@ietf.org
https://www.ietf.org/mailman/listinfo/dtn