Re: [manet] Security documents for OLSRv2/NHDP

[Ulrich Herberg <[e-mail]>]

AB,

we specified a integrity and replay security protection for OLSRv2, as
requested by Stephen. We could have added that directly in OLSRv2, but
since NHDP uses the same security mechanism, that would have been a
copy of the same text. So we decided to specify the mechanism in a new
draft, which is normatively referenced by OLSRv2, e.g.:
"A conformant implementation of OLSRv2 MUST, at minimum, implement the
security mechanisms specified in [draft-herberg-manet-nhdp-olsrv2-sec]
..."
At the same time this new draft "updates" (in the IETF sense) NHDP by
mandating to implement the security mechanism.

The new OLSRv2 revision (as well as new revisions of the two security
drafts) will be submitted in the next few days, we are just doing
final reviews amongst the authors.

Best regards
Ulrich


On Sat, Mar 16, 2013 at 6:42 PM, Adrian Farrel <[e-mail]> wrote:
> Yes, I believe the plan is to add more security text to the OLSRv2 draft. The
> choice of words is confusing :-)
> "Update" has a general meaning: to update a draft means to make some revisions.
> "Update" has a specific meaning: to update an RFC means to add a meta-data tag
> formally noting that one RFC updates another.
>
> Adrian
>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On Behalf Of
>> Abdussalam Baryun
>> Sent: 16 March 2013 20:54
>> To: manet
>> Subject: Re: [manet] Security documents for OLSRv2/NHDP
>>
>> I agreed to update of RFC6130 and have no objection of others, but
>> want to discuss/ask.
>>
>> If IESG-DISCUSS was about OLSRv2 document why the process was to
>> update RFC6130 only? and if publication 1 mandates OLSRv2 messages,
>> then IMO it needs to update OLSRv2 document as well, or do you mean
>> the publication-3 is a new version -18 that includes the security of
>> OLSRv2 messaging and refers to publication-1.
>>
>> AB
>>
>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>> This message is owned by the author and sent to IETF MANET address and
>> not sent to private mail-boxes. This message is an IETF input not
>> private input.
>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>
>> On 3/15/13, Christopher Dearlove <[e-mail]>
>> wrote:
>> > OLSRv2 will reference this draft, and therefore it's not an update in the
>> > technical sense in which the term is being used here, as a formal update to
>> > RFC 6130.
>> >
>> > On 15 Mar 2013, at 21:09, Abdussalam Baryun wrote:
>> >
>> >> Hi Ulrich,
>> >>
>> >> Do I understand that publication 1 updates both RFC6130 and OLSRv2, or
>> >> do you mean only updates RFC6130,
>> >>
>> >> AB
>> >> On 3/15/13, Ulrich Herberg <[e-mail]> wrote:
>> >>> Dear all,
>> >>>
>> >>> The OLSRv2 authors have had a discussion with Stephen Farrell (Security
>> >>> AD)
>> >>> and Adrian about how to resolve the remaining security related DISCUSS
>> >>> on OLSRv2, and we agreed on a way forward that involves the following
>> >>> steps:
>> >>>
>> >>> 1) Publication of:
>> >>> http://tools.ietf.org/html/draft-herberg-manet-nhdp-olsrv2-sec-01
>> >>>
>> >>> This document mandates (at least) implementation of HMAC/SHA2
>> >>> integrity protection of OLSRv2 messages. Deployments of OLSRv2 should
>> >>> use that mechanism unless they have a more appropriate solution (e.g.,
>> >>> different cipher) for that particular deployment. This document also
>> >>> updates NHDP and mandates to implement the same HMAC/SHA2
>> protection
>> >>> for HELLO messages.
>> >>>
>> >>> 2) Publication of:
>> >>> http://tools.ietf.org/html/draft-herberg-manet-rfc6622-bis-01
>> >>>
>> >>> This document obsoletes RFC6622bis by fixing an oversight in RFC6622.
>> >>> The differences are minor to RFC6622 and can be seen here:
>> >>> http://tools.ietf.org/rfcdiff?url1=rfc6622&url2=draft-herberg-manet-
>> rfc6622-bis
>> >>> Essentially, RFC6622 does not protect the IP source address of the
>> >>> interface over which the control message is sent. Since that address
>> >>> is used to establish neighbors in NHDP (and therefore must be
>> >>> protected), a new type extension 3 of the ICV TLV has been added to
>> >>> the registry.
>> >>>
>> >>> 3) Publication of an update to OLSRv2, referencing the use of the
>> >>> defined security mechanism, and resolving other smaller issues from
>> >>> Stephen's DISCUSS.
>> >>>
>> >>> In order to not hold up OLSRv2 further, and upon discussions with Stan
>> >>> and Adrian, we would like to request WG adoption of these two new
>> >>> documents - asking that the chairs will officially poll the WG on this
>> >>> matter shortly. The documents are brief, and addresses issues
>> >>> requested by the ADs, so we hope that processing them should also be a
>> >>> brief affair.
>> >>>
>> >>> Best regards
>> >>> Ulrich
>> >>> _______________________________________________
>> >>> manet mailing list
>> >>> [e-mail]
>> >>> https://www.ietf.org/mailman/listinfo/manet
>> >>>
>> >> _______________________________________________
>> >> manet mailing list
>> >> [e-mail]
>> >> https://www.ietf.org/mailman/listinfo/manet
>> >
>> >
>> _______________________________________________
>> manet mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/manet
>
> _______________________________________________
> manet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/manet