Re: [Roll] security solutions for ROLL

[Levente Buttyan <[e-mail]>]

Dear Michael,

Our work on version number and rank authentication addresses some
layer-3 security issues that is not addressed by layer-2 security
mechanisms. In particular, layer-2 protection does not prevent a
malfunctioning or misbehaving (compromised) node from initiating the
reconstruction of the DODAG with itself as the root. Also manipulating
the rank value in DIO messages may result in the distortion of the
topolgy, i.e., a misbehaving node can appear to be closer to the root
than it really is. The mechanisms that we proposed try to prevent these
misdeeds. They are also lightweight, using hash functions and symmetric
key crypto as much as possible.

Our draft is available at:
http://tools.ietf.org/html/draft-dvir-roll-security-authentication-01

We also have an implementation (on both TinyOS and Linux) of RPL and the
version number authentication mechanisms that we plan to make available
soon.

My colleague, Amit Dvir will be in Paris for the IETF meeting to present
this work and to discuss it further.

Best regards,
Levente Buttyan


2012.02.23. 22:51 keltezéssel, Michael Richardson írta:
> 
> 1) there is an Security AD DISCUSS from Stephen Farrell/Tim Polk.
>    http://datatracker.ietf.org/doc/draft-ietf-roll-security-framework/ballot/#stephen-farrell
>    It has been there for 9 months, and we need to act on it, because
>    this DISCUSS is keeping draft-ietf-roll-of0-20 from advancing,
>    and that will keep draft-ietf-roll-rpl-19 from being published.
> 
> So to be clear, this chain of dependancies/references means that while
> rpl-19 has been done for some time, it won't get published until we do
> something.
> 
> Stephen Farrell will lift his DISCUSS on this and let us proceed if he
> sees some credible plan to get useable security into the layer-3 of
> RPL.  
> 
> For a lot of you, you have assumed security at layer-2 is enough, and
> you may never care about this mechanism, but I still need your
> participation here.  
> 
> 2) We will need to provide, in the draft-ietf-roll-security-framework,
>    a clear set of security related *questions* that each applicability
>    statement will need to answer.  In esssence, this is a template
>    that needs to be filled out.
> 
> 3) A proposal for moving forward is to adopt/adapt MIKEY
>    (RFC3830) for our uses.
>    This has been proposed in:
>       draft-alexander-roll-mikey-lln-key-mgmt 
> 
>    This draft needs to be resubmitted for the WG to consider it.
>    (A rumour is that it can be found at: 
>      http://tools.ietf.org/id/draft-alexander-roll-mikey-lln-key-mgmt-02.txt
>    )
> 
>   The WG is open to other proposals, but they need to come in quickly.
>   We do not need to complete the work, but we do need to know what work
> we need to do, and we need to update our milestones to include that work
> in order that we can progress.
> 
> 
> 
> 
> _______________________________________________
> Roll mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/roll

-- 
Dr. Levente Buttyán
Laboratory of Cryptography and System Security (CrySyS)
Department of Telecommunications
Budapest University of Technology and Economics (BME)
URL: http://www.crysys.hu/