Re: [manet] Security documents for OLSRv2/NHDP

[Christopher Dearlove <[e-mail]>]

As Ulrich said, done that way we end up repeating a whole lot of text in both documents, which really isn't sensible, and introduces an editorial issue of keeping the two aligned. Putting it all together gives a much more coherent presentation.

As for late in the day, we worked on the assumption that what was good enough for NHDP was good enough for OLSRv2. We were, as you know, working towards security in the WG. However in effect a new security AD had a different view to an old security AD, that something had to be done now, before OLSRv2 was published, and held a DISCUSS accordingly. And as OLSRv2 security depends on NHDP security that needed doing too.

No one wants everything finished as soon as soon as possible more than I and the other authors do. But we are here, and doing the best we can.

-- 
Christopher Dearlove
[e-mail] (iPhone)
[e-mail] (home)

On 17 Mar 2013, at 03:53, "Stan Ratliff (sratliff)" <[e-mail]> wrote:

> Ulrich, 
> 
> Just to be clear: Since the plan is to add a normative reference to OLSRv2, it (meaning the OLSRv2 draft) will be held up, pending WG adoption/acceptance/WGLC of this new draft…
> 
> (Taking my co-chair hat off, and speaking just as a WG participant): 
> I would have preferred inserting the text directly into OLSRv2 (and NHDP if need be) instead of creating the normative reference. I think this is a tad late in the game to be doing such a thing. 
> 
> Regards,
> Stan
> 
> 
> On Mar 16, 2013, at 7:46 PM, Ulrich Herberg wrote:
> 
>> AB,
>> 
>> we specified a integrity and replay security protection for OLSRv2, as
>> requested by Stephen. We could have added that directly in OLSRv2, but
>> since NHDP uses the same security mechanism, that would have been a
>> copy of the same text. So we decided to specify the mechanism in a new
>> draft, which is normatively referenced by OLSRv2, e.g.:
>> "A conformant implementation of OLSRv2 MUST, at minimum, implement the
>> security mechanisms specified in [draft-herberg-manet-nhdp-olsrv2-sec]
>> ..."
>> At the same time this new draft "updates" (in the IETF sense) NHDP by
>> mandating to implement the security mechanism.
>> 
>> The new OLSRv2 revision (as well as new revisions of the two security
>> drafts) will be submitted in the next few days, we are just doing
>> final reviews amongst the authors.
>> 
>> Best regards
>> Ulrich
>> 
>> 
>> On Sat, Mar 16, 2013 at 6:42 PM, Adrian Farrel <[e-mail]> wrote:
>>> Yes, I believe the plan is to add more security text to the OLSRv2 draft. The
>>> choice of words is confusing :-)
>>> "Update" has a general meaning: to update a draft means to make some revisions.
>>> "Update" has a specific meaning: to update an RFC means to add a meta-data tag
>>> formally noting that one RFC updates another.
>>> 
>>> Adrian
>>> 
>>>> -----Original Message-----
>>>> From: [e-mail] [mailto:[e-mail]] On Behalf Of
>>>> Abdussalam Baryun
>>>> Sent: 16 March 2013 20:54
>>>> To: manet
>>>> Subject: Re: [manet] Security documents for OLSRv2/NHDP
>>>> 
>>>> I agreed to update of RFC6130 and have no objection of others, but
>>>> want to discuss/ask.
>>>> 
>>>> If IESG-DISCUSS was about OLSRv2 document why the process was to
>>>> update RFC6130 only? and if publication 1 mandates OLSRv2 messages,
>>>> then IMO it needs to update OLSRv2 document as well, or do you mean
>>>> the publication-3 is a new version -18 that includes the security of
>>>> OLSRv2 messaging and refers to publication-1.
>>>> 
>>>> AB
>>>> 
>>>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>>> This message is owned by the author and sent to IETF MANET address and
>>>> not sent to private mail-boxes. This message is an IETF input not
>>>> private input.
>>>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>>> 
>>>> On 3/15/13, Christopher Dearlove <[e-mail]>
>>>> wrote:
>>>>> OLSRv2 will reference this draft, and therefore it's not an update in the
>>>>> technical sense in which the term is being used here, as a formal update to
>>>>> RFC 6130.
>>>>> 
>>>>> On 15 Mar 2013, at 21:09, Abdussalam Baryun wrote:
>>>>> 
>>>>>> Hi Ulrich,
>>>>>> 
>>>>>> Do I understand that publication 1 updates both RFC6130 and OLSRv2, or
>>>>>> do you mean only updates RFC6130,
>>>>>> 
>>>>>> AB
>>>>>> On 3/15/13, Ulrich Herberg <[e-mail]> wrote:
>>>>>>> Dear all,
>>>>>>> 
>>>>>>> The OLSRv2 authors have had a discussion with Stephen Farrell (Security
>>>>>>> AD)
>>>>>>> and Adrian about how to resolve the remaining security related DISCUSS
>>>>>>> on OLSRv2, and we agreed on a way forward that involves the following
>>>>>>> steps:
>>>>>>> 
>>>>>>> 1) Publication of:
>>>>>>> http://tools.ietf.org/html/draft-herberg-manet-nhdp-olsrv2-sec-01
>>>>>>> 
>>>>>>> This document mandates (at least) implementation of HMAC/SHA2
>>>>>>> integrity protection of OLSRv2 messages. Deployments of OLSRv2 should
>>>>>>> use that mechanism unless they have a more appropriate solution (e.g.,
>>>>>>> different cipher) for that particular deployment. This document also
>>>>>>> updates NHDP and mandates to implement the same HMAC/SHA2
>>>> protection
>>>>>>> for HELLO messages.
>>>>>>> 
>>>>>>> 2) Publication of:
>>>>>>> http://tools.ietf.org/html/draft-herberg-manet-rfc6622-bis-01
>>>>>>> 
>>>>>>> This document obsoletes RFC6622bis by fixing an oversight in RFC6622.
>>>>>>> The differences are minor to RFC6622 and can be seen here:
>>>>>>> http://tools.ietf.org/rfcdiff?url1=rfc6622&url2=draft-herberg-manet-
>>>> rfc6622-bis
>>>>>>> Essentially, RFC6622 does not protect the IP source address of the
>>>>>>> interface over which the control message is sent. Since that address
>>>>>>> is used to establish neighbors in NHDP (and therefore must be
>>>>>>> protected), a new type extension 3 of the ICV TLV has been added to
>>>>>>> the registry.
>>>>>>> 
>>>>>>> 3) Publication of an update to OLSRv2, referencing the use of the
>>>>>>> defined security mechanism, and resolving other smaller issues from
>>>>>>> Stephen's DISCUSS.
>>>>>>> 
>>>>>>> In order to not hold up OLSRv2 further, and upon discussions with Stan
>>>>>>> and Adrian, we would like to request WG adoption of these two new
>>>>>>> documents - asking that the chairs will officially poll the WG on this
>>>>>>> matter shortly. The documents are brief, and addresses issues
>>>>>>> requested by the ADs, so we hope that processing them should also be a
>>>>>>> brief affair.
>>>>>>> 
>>>>>>> Best regards
>>>>>>> Ulrich
>>>>>>> _______________________________________________
>>>>>>> manet mailing list
>>>>>>> [e-mail]
>>>>>>> https://www.ietf.org/mailman/listinfo/manet
>>>>>>> 
>>>>>> _______________________________________________
>>>>>> manet mailing list
>>>>>> [e-mail]
>>>>>> https://www.ietf.org/mailman/listinfo/manet
>>>>> 
>>>>> 
>>>> _______________________________________________
>>>> manet mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/manet
>>> 
>>> _______________________________________________
>>> manet mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/manet
>> _______________________________________________
>> manet mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/manet
> 
> _______________________________________________
> manet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/manet