Re: [Roll] Stephen Farrell's No Objection on charter-ietf-roll-04-06: (with COMMENT)

[peter van der Stok <[e-mail]>]

Hi Stephen,

Indeed, formulating security attacks, analysing their consequences, and 
findig adequate remedies for a routing protocol is a challenging task.
It starts with formulating the attacks, which in my understanding evolve 
over time.

In the 6lo WG a draft has been written to handle privacy issues in a 
coherent way; which proves extremely useful during the IP-over-foo draft 
discussions.
In Roll Michael has written a template for the applicabiity statements, 
including security issues.

In my opinion a draft which helps identifying the threats and their 
(existing) remedies could be a proper way forward.
For Roll such a draft together with Manet, which faces similar wireless 
issues, might be a good starting point.

Any other suggestions, or showing this one to be inadequate, are 
welcome.

peter,
> 
> The charter continues to say "The Working Group will pay
> particular attention to routing security..."
> 
> How do we think that's going? I'm not sure that it's going
> that well - we seem to have a history where ROLL documents
> arrive at the IESG lacking security analysis. I don't think
> that's because folks are bad or lazy, but it's maybe more
> down to people assuming that security is someone else's
> problem (e.g. will be handled by layer 2, or will be part
> of some applicability statement, or will be handled by
> some RPL security document etc...)
> 
> Anyway, now that we're re-chartering, maybe it's a good
> time to review how we've been doing on this, given the
> history and see if there's anything we could do to avoid
> problems arising for future ROLL documents. (I don't have
> any specific suggestion for what to do, I just wanted to
> see if a discussion of this might be useful.)
>