[manet] Stephen Farrell's Discuss on draft-ietf-manet-olsrv2-sec-threats-03: (with DISCUSS)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-manet-olsrv2-sec-threats-03: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-manet-olsrv2-sec-threats/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------


I have two things I'd like to discuss to see if
changes are needed or not:

(1) Neither this nor RFC7186 seem to consider battery
depletion attacks. Why is that ok?

(2) 6.2: HMAC is *not* a digital signature mechanism.
While loose terminology may be ok elsewhere, in this
case, you shouldn't do that as it can lead to wrong
conclusions. Digital signatures do provide origin
authentication of sorts, but MACs do not, especially
if keys are shared. It is not clear to me that some of
the claims in 6.2.x of attacks being mitigated are in
fact correct, given shared secrets. (Note: It could be
that the claims are correct, I didn't have time to
check back on all the vulnerability definitions,
sorry. But I'd like to check, given the defective
terminology.)