Re: [manet] Security documents for OLSRv2/NHDP

["Dearlove, Christopher (UK)" <[e-mail]>]

The new versions are now submitted. OLSRv2 security (integrity) is at -02, RFC6622bis is at -02 and OLSRv2 is at -18.

-- 
Christopher Dearlove
Senior Principal Engineer, Communications Group
Communications, Networks and Image Analysis Capability
BAE Systems Advanced Technology Centre
West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
Tel: [phone] |  Fax: [phone]
[e-mail] | http://www.baesystems.com

BAE Systems (Operations) Limited
Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre, Farnborough, Hants, GU14 6YU, UK
Registered in England & Wales No: 1996687


-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Ulrich Herberg
Sent: 16 March 2013 23:47
To: [e-mail]
Cc: manet
Subject: Re: [manet] Security documents for OLSRv2/NHDP

----------------------! WARNING ! ----------------------
This message originates from outside our organisation,
either from an external partner or from the internet.
Keep this in mind if you answer this message.
Follow the 'Report Suspicious Emails' link on IT matters
for instructions on reporting suspicious email messages.
--------------------------------------------------------

AB,

we specified a integrity and replay security protection for OLSRv2, as
requested by Stephen. We could have added that directly in OLSRv2, but
since NHDP uses the same security mechanism, that would have been a
copy of the same text. So we decided to specify the mechanism in a new
draft, which is normatively referenced by OLSRv2, e.g.:
"A conformant implementation of OLSRv2 MUST, at minimum, implement the
security mechanisms specified in [draft-herberg-manet-nhdp-olsrv2-sec]
..."
At the same time this new draft "updates" (in the IETF sense) NHDP by
mandating to implement the security mechanism.

The new OLSRv2 revision (as well as new revisions of the two security
drafts) will be submitted in the next few days, we are just doing
final reviews amongst the authors.

Best regards
Ulrich


On Sat, Mar 16, 2013 at 6:42 PM, Adrian Farrel <[e-mail]> wrote:
> Yes, I believe the plan is to add more security text to the OLSRv2 draft. The
> choice of words is confusing :-)
> "Update" has a general meaning: to update a draft means to make some revisions.
> "Update" has a specific meaning: to update an RFC means to add a meta-data tag
> formally noting that one RFC updates another.
>
> Adrian
>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On Behalf Of
>> Abdussalam Baryun
>> Sent: 16 March 2013 20:54
>> To: manet
>> Subject: Re: [manet] Security documents for OLSRv2/NHDP
>>
>> I agreed to update of RFC6130 and have no objection of others, but
>> want to discuss/ask.
>>
>> If IESG-DISCUSS was about OLSRv2 document why the process was to
>> update RFC6130 only? and if publication 1 mandates OLSRv2 messages,
>> then IMO it needs to update OLSRv2 document as well, or do you mean
>> the publication-3 is a new version -18 that includes the security of
>> OLSRv2 messaging and refers to publication-1.
>>
>> AB
>>
>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>> This message is owned by the author and sent to IETF MANET address and
>> not sent to private mail-boxes. This message is an IETF input not
>> private input.
>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>
>> On 3/15/13, Christopher Dearlove <[e-mail]>
>> wrote:
>> > OLSRv2 will reference this draft, and therefore it's not an update in the
>> > technical sense in which the term is being used here, as a formal update to
>> > RFC 6130.
>> >
>> > On 15 Mar 2013, at 21:09, Abdussalam Baryun wrote:
>> >
>> >> Hi Ulrich,
>> >>
>> >> Do I understand that publication 1 updates both RFC6130 and OLSRv2, or
>> >> do you mean only updates RFC6130,
>> >>
>> >> AB
>> >> On 3/15/13, Ulrich Herberg <[e-mail]> wrote:
>> >>> Dear all,
>> >>>
>> >>> The OLSRv2 authors have had a discussion with Stephen Farrell (Security
>> >>> AD)
>> >>> and Adrian about how to resolve the remaining security related DISCUSS
>> >>> on OLSRv2, and we agreed on a way forward that involves the following
>> >>> steps:
>> >>>
>> >>> 1) Publication of:
>> >>> http://tools.ietf.org/html/draft-herberg-manet-nhdp-olsrv2-sec-01
>> >>>
>> >>> This document mandates (at least) implementation of HMAC/SHA2
>> >>> integrity protection of OLSRv2 messages. Deployments of OLSRv2 should
>> >>> use that mechanism unless they have a more appropriate solution (e.g.,
>> >>> different cipher) for that particular deployment. This document also
>> >>> updates NHDP and mandates to implement the same HMAC/SHA2
>> protection
>> >>> for HELLO messages.
>> >>>
>> >>> 2) Publication of:
>> >>> http://tools.ietf.org/html/draft-herberg-manet-rfc6622-bis-01
>> >>>
>> >>> This document obsoletes RFC6622bis by fixing an oversight in RFC6622.
>> >>> The differences are minor to RFC6622 and can be seen here:
>> >>> http://tools.ietf.org/rfcdiff?url1=rfc6622&url2=draft-herberg-manet-
>> rfc6622-bis
>> >>> Essentially, RFC6622 does not protect the IP source address of the
>> >>> interface over which the control message is sent. Since that address
>> >>> is used to establish neighbors in NHDP (and therefore must be
>> >>> protected), a new type extension 3 of the ICV TLV has been added to
>> >>> the registry.
>> >>>
>> >>> 3) Publication of an update to OLSRv2, referencing the use of the
>> >>> defined security mechanism, and resolving other smaller issues from
>> >>> Stephen's DISCUSS.
>> >>>
>> >>> In order to not hold up OLSRv2 further, and upon discussions with Stan
>> >>> and Adrian, we would like to request WG adoption of these two new
>> >>> documents - asking that the chairs will officially poll the WG on this
>> >>> matter shortly. The documents are brief, and addresses issues
>> >>> requested by the ADs, so we hope that processing them should also be a
>> >>> brief affair.
>> >>>
>> >>> Best regards
>> >>> Ulrich
>> >>> _______________________________________________
>> >>> manet mailing list
>> >>> [e-mail]
>> >>> https://www.ietf.org/mailman/listinfo/manet
>> >>>
>> >> _______________________________________________
>> >> manet mailing list
>> >> [e-mail]
>> >> https://www.ietf.org/mailman/listinfo/manet
>> >
>> >
>> _______________________________________________
>> manet mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/manet
>
> _______________________________________________
> manet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/manet
_______________________________________________
manet mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/manet


********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************