Re: [manet] DLEP-18 Security Considerations

[Henning Rogge <[e-mail]>]

On Sat, Feb 6, 2016 at 11:22 PM, Alvaro Retana (aretana)
<[e-mail]> wrote:
> On 1/18/16, 7:51 PM, "manet on behalf of Stan Ratliff"
> <[e-mail] on behalf of [e-mail]> wrote:
>
> Stan:
>
> Hi!
>
> You'll need references for L2 security.
>
> The main problem I see with the text below is that it is based on
> assumptions — even though you do say that "DLEP is restricted to…a single
> (possibly logical) hop at layer 2", it is based on the deployment
> assumptions.  What happens if it isn't deployed that way?

It will not work because the user traffic will not reach the
destination. DLEP is the model of a "external radio" which acts as a
bridge (as in "layer-2 bridge") between the connection to the router
and the radio network.

If you are more than 1 IP-hop away you will not get the user traffic.

> What about confidentiality of the data?  What about exposing information
> about users (privacy)?

if you have one IP-hop between radio and router linklayer/MAC security
takes care of this. If not you are outside the specification of the
protocol and do something strange to the traffic anyways... so it
should not be DLEP's problem.

>  I know that the assumed deployment model makes it
> very hard to look at the data in flight between and the physical and L2
> security may well be enough.  However, what if DLEP is not used as expected?

If you break the basic assumptions of the protocol, you should not
expect its security considerations to be secure in your situation.

> IMO, you should describe the expected operating environment (or point to the
> assumptions) and any security mechanisms that should be included there (L2,
> physical assumptions), and explain why confidentiality and privacy are not a
> concern…

http://tools.ietf.org/html/draft-ietf-manet-dlep-18#section-2.1

> but then you should also say something like: "if DLEP is used in an
> environment other then the expected one, then xx, yy and zz MUST/SHOULD be
> implemented".   I think that this way we would be covering the normal case,
> but also providing an answer to what if without making mandatory mechanisms
> that may be superfluous.

There is no guarantee that xx/yy/zz will give you any kind of security
in an unspecified environment.

Henning Rogge