Re: [manet] Security documents for OLSRv2/NHDP

["Stan Ratliff (sratliff)" <[e-mail]>]

Ulrich, 

Just to be clear: Since the plan is to add a normative reference to OLSRv2, it (meaning the OLSRv2 draft) will be held up, pending WG adoption/acceptance/WGLC of this new draft…

(Taking my co-chair hat off, and speaking just as a WG participant): 
I would have preferred inserting the text directly into OLSRv2 (and NHDP if need be) instead of creating the normative reference. I think this is a tad late in the game to be doing such a thing. 

Regards,
Stan


On Mar 16, 2013, at 7:46 PM, Ulrich Herberg wrote:

> AB,
> 
> we specified a integrity and replay security protection for OLSRv2, as
> requested by Stephen. We could have added that directly in OLSRv2, but
> since NHDP uses the same security mechanism, that would have been a
> copy of the same text. So we decided to specify the mechanism in a new
> draft, which is normatively referenced by OLSRv2, e.g.:
> "A conformant implementation of OLSRv2 MUST, at minimum, implement the
> security mechanisms specified in [draft-herberg-manet-nhdp-olsrv2-sec]
> ..."
> At the same time this new draft "updates" (in the IETF sense) NHDP by
> mandating to implement the security mechanism.
> 
> The new OLSRv2 revision (as well as new revisions of the two security
> drafts) will be submitted in the next few days, we are just doing
> final reviews amongst the authors.
> 
> Best regards
> Ulrich
> 
> 
> On Sat, Mar 16, 2013 at 6:42 PM, Adrian Farrel <[e-mail]> wrote:
>> Yes, I believe the plan is to add more security text to the OLSRv2 draft. The
>> choice of words is confusing :-)
>> "Update" has a general meaning: to update a draft means to make some revisions.
>> "Update" has a specific meaning: to update an RFC means to add a meta-data tag
>> formally noting that one RFC updates another.
>> 
>> Adrian
>> 
>>> -----Original Message-----
>>> From: [e-mail] [mailto:[e-mail]] On Behalf Of
>>> Abdussalam Baryun
>>> Sent: 16 March 2013 20:54
>>> To: manet
>>> Subject: Re: [manet] Security documents for OLSRv2/NHDP
>>> 
>>> I agreed to update of RFC6130 and have no objection of others, but
>>> want to discuss/ask.
>>> 
>>> If IESG-DISCUSS was about OLSRv2 document why the process was to
>>> update RFC6130 only? and if publication 1 mandates OLSRv2 messages,
>>> then IMO it needs to update OLSRv2 document as well, or do you mean
>>> the publication-3 is a new version -18 that includes the security of
>>> OLSRv2 messaging and refers to publication-1.
>>> 
>>> AB
>>> 
>>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>> This message is owned by the author and sent to IETF MANET address and
>>> not sent to private mail-boxes. This message is an IETF input not
>>> private input.
>>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>> 
>>> On 3/15/13, Christopher Dearlove <[e-mail]>
>>> wrote:
>>>> OLSRv2 will reference this draft, and therefore it's not an update in the
>>>> technical sense in which the term is being used here, as a formal update to
>>>> RFC 6130.
>>>> 
>>>> On 15 Mar 2013, at 21:09, Abdussalam Baryun wrote:
>>>> 
>>>>> Hi Ulrich,
>>>>> 
>>>>> Do I understand that publication 1 updates both RFC6130 and OLSRv2, or
>>>>> do you mean only updates RFC6130,
>>>>> 
>>>>> AB
>>>>> On 3/15/13, Ulrich Herberg <[e-mail]> wrote:
>>>>>> Dear all,
>>>>>> 
>>>>>> The OLSRv2 authors have had a discussion with Stephen Farrell (Security
>>>>>> AD)
>>>>>> and Adrian about how to resolve the remaining security related DISCUSS
>>>>>> on OLSRv2, and we agreed on a way forward that involves the following
>>>>>> steps:
>>>>>> 
>>>>>> 1) Publication of:
>>>>>> http://tools.ietf.org/html/draft-herberg-manet-nhdp-olsrv2-sec-01
>>>>>> 
>>>>>> This document mandates (at least) implementation of HMAC/SHA2
>>>>>> integrity protection of OLSRv2 messages. Deployments of OLSRv2 should
>>>>>> use that mechanism unless they have a more appropriate solution (e.g.,
>>>>>> different cipher) for that particular deployment. This document also
>>>>>> updates NHDP and mandates to implement the same HMAC/SHA2
>>> protection
>>>>>> for HELLO messages.
>>>>>> 
>>>>>> 2) Publication of:
>>>>>> http://tools.ietf.org/html/draft-herberg-manet-rfc6622-bis-01
>>>>>> 
>>>>>> This document obsoletes RFC6622bis by fixing an oversight in RFC6622.
>>>>>> The differences are minor to RFC6622 and can be seen here:
>>>>>> http://tools.ietf.org/rfcdiff?url1=rfc6622&url2=draft-herberg-manet-
>>> rfc6622-bis
>>>>>> Essentially, RFC6622 does not protect the IP source address of the
>>>>>> interface over which the control message is sent. Since that address
>>>>>> is used to establish neighbors in NHDP (and therefore must be
>>>>>> protected), a new type extension 3 of the ICV TLV has been added to
>>>>>> the registry.
>>>>>> 
>>>>>> 3) Publication of an update to OLSRv2, referencing the use of the
>>>>>> defined security mechanism, and resolving other smaller issues from
>>>>>> Stephen's DISCUSS.
>>>>>> 
>>>>>> In order to not hold up OLSRv2 further, and upon discussions with Stan
>>>>>> and Adrian, we would like to request WG adoption of these two new
>>>>>> documents - asking that the chairs will officially poll the WG on this
>>>>>> matter shortly. The documents are brief, and addresses issues
>>>>>> requested by the ADs, so we hope that processing them should also be a
>>>>>> brief affair.
>>>>>> 
>>>>>> Best regards
>>>>>> Ulrich
>>>>>> _______________________________________________
>>>>>> manet mailing list
>>>>>> [e-mail]
>>>>>> https://www.ietf.org/mailman/listinfo/manet
>>>>>> 
>>>>> _______________________________________________
>>>>> manet mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/manet
>>>> 
>>>> 
>>> _______________________________________________
>>> manet mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/manet
>> 
>> _______________________________________________
>> manet mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/manet
> _______________________________________________
> manet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/manet