Re: [manet] I-D Action: draft-ietf-manet-nhdp-sec-threats-01.txt

[Henning Rogge <[e-mail]>]

On 02/25/2013 08:49 AM, Abdussalam Baryun wrote:
>> after this you should read the NHDP RFC again, especially the
>> section you are talking about (Section 14.4 I think).
>>
>> after doing this too, you will notice RFC6130 talks about the
>> possibility to use **packet** sequence numbers.
>>
>> Packet sequence numbers are not used to detect incoming duplicates,
>> you are mixing things up with message sequence numbers.
>
> I mean both sequence are important otherwise why do we have them in
> our work,

You certainly do not understand the "duplicate detection poison" attack.

>> In my opinion message sequence numbers are USELESS for hysteresis
>> calculation, because the NHDP Hello messages will not have a
>> continuous sequence (no pun intended) of message sequence numbers
>> (unless you ONLY run NHDP and do not combine it with another
>> protocol).
>
> If useless then you should remove them why making things difficult,

Okay, I will explain it once again.

RFC6130 mentions the possibility (among other things) to use packet
sequence numbers for hysteresis calculations, without going into details
what to do with them.

Because of this its a not a good idea to describe the "drop duplicate 
because of spoofed high sequence numbers attack", because the attack 
does not apply to this case at all. The duplicate detection described 
for RFC5444 does only work for message sequence numbers.

An attack on packet sequence level would not be a NHDP attack but a 
RFC5444 (de-)multiplixer attack, which would belong into a 
packetbb-sec-threats document.

>> Any attack mitigation for NHDP sequence numbers will highly depend
>> on the hysteresis implementation, which makes the value of your
>> request dubious at best.
>
> Ok why does the document not talk about the hysteresis implementation
> then :)

There was a hysteresis implementation example in OLSRv1 (RFC3626)... it
didn't worked well. I think that is the reason NHDP only gives some 
hints what you could look at when implementing a hysteresis function.

NHDP also mentions the possibility to use signal-to-noise ratio or 
packet-acknowledgements.

Do you want to add "threats descriptions and mitigations" to this 
attacks too?

If I ever write down my "packet sequence number based ETX", it should 
contain a "security" section because it would be the first Manet-WG 
document using the packet sequence numbers I think.

Henning Rogge

-- 
Diplom-Informatiker Henning Rogge , Fraunhofer-Institut für
Kommunikation, Informationsverarbeitung und Ergonomie FKIE
Kommunikationssysteme (KOM)
Fraunhofer Straße 20, 53343 Wachtberg, Germany
Telefon [phone],   Fax [phone]
mailto:[e-mail] http://www.fkie.fraunhofer.de