Re: [secdir] secdir review of draft-ietf-6tisch-architecture-21

[David Mandelberg <[e-mail]>]

-23 looks good. Thank you all for doing the work to secure the protocols!

On 6/28/19 6:59 AM, Pascal Thubert (pthubert) wrote:
> Hello David
> 
> Many thanks again. Your comments steered great discussions that led to improvements in both this draft and minimal security.
> I posted -23 in the hope that it satisfies all your comments. Please let us know is there is any additional issue we need to look at.
>   
> All the best,
>   
> Pascal
> 
>> -----Original Message-----
>> From: Michael Richardson <[e-mail]>
>> Sent: mercredi 26 juin 2019 17:54
>> To: Pascal Thubert (pthubert) <[e-mail]>
>> Cc: Tero Kivinen <[e-mail]>; David Mandelberg
>> <[e-mail]>; [e-mail]; [e-mail]; draft-ietf-6tisch-
>> [e-mail]; Thomas Watteyne <[e-mail]>;
>> =?iso-8859-2?Q?Mali=B9a_Vu=E8ini=E6?= <[e-mail]>
>> Subject: Re: [secdir] secdir review of draft-ietf-6tisch-architecture-21
>>
>>
>> Pascal Thubert (pthubert) <[e-mail]> wrote:
>>      >> Tero:
>>      >> >> Note, that attacker might be able to replay valid ACKs for the frame
>>      >> >> sent by the JN, provided that the JRC (or whoever JN sent the message
>>      >> >> to) happened to ack message using the same ASN attacker faked for
>> JN.
>>      >>
>>      >> Pascal Thubert (pthubert) <[e-mail]> wrote:
>>      >> > Your mean that the faked ASN is only slightly in the future, so the
>>      >> > attacker can repeat messages from the pledge after that delay?
>>      >>
>>      >> The faked ASN is always in the past.
>>
>>      > Do you mean the replayed ones? When the pledge does not have the keys,
>>      > the attacker can forge the beacon with any ASN, and place random bytes
>>      > in the MIC, can't it?
>>
>> Yes, the replayed one has a "fake" ASN that is in the past.
>>
>>      > If the attacker fakes an ASN that is tomorrow and intercepts a join
>>      > request, it could make the pledge seem to appear now on the network
>>      > tomorrow even if the real pledge is long gone.
>>
>> But that one won't validate.
>>
>>      >> So the L2-ACKs can be faked, was the point.
>>
>>      > I can see that an ACK can be replayed. But the ACK that was stored in
>>      > advance can only work if the attacked node speaks on the very ASN for
>>      > which the attacker intercepted an ACK in the past. The attacker is not
>>      > in control of that and that makes its life harder.
>>
>> When I said faked, I should have said replayed.
>>
>> I think that we don't need to do this: just wait for a beacon.  If the attacker can
>> block and replay them all, then they absolutely win, and the network can not
>> form.  Such an attacker probably can also put faraday cages around all the
>> nodes.
>>
>> --
>> Michael Richardson <[e-mail]>, Sandelman Software Works  -
>> = IPv6 IoT consulting =-
>