[secdir] Security review of draft-ietf-6tisch-minimal-security-12

[Mališa Vučinić <[e-mail]>]

Dear Hilarie,
Thank you for going over the document. Please see the responses inline. Proposed changes to the working version of the document following your review can be found at:
https://bitbucket.org/6tisch/draft-ietf-6tisch-minimal-security/commits/8d77145e63531b604a7d4df4197515ffebde0927 <https://bitbucket.org/6tisch/draft-ietf-6tisch-minimal-security/commits/8d77145e63531b604a7d4df4197515ffebde0927>
Kind regards,
Mališa

>        Security review of Minimal Security Framework for 6TiSCH
> 		draft-ietf-6tisch-minimal-security-12
> 
> Do not be alarmed.  I generated this review of this document as part
> of the security directorate's ongoing effort to review all IETF
> documents being processed by the IESG.  These comments were written
> with the intent of improving security requirements and considerations
> in IETF drafts.  Comments not addressed in last call may be included
> in AD reviews during the IESG review.  Document editors and WG chairs
> should treat these comments just like any other last call comments.
> 
> Nodes can join a 6TiSCH (IPv6 over the TSCH mode of IEEE 802.15.4e)
> network) by issuing a request that is validated using pre-shared
> keys.  The document defines the Constrained Join Protocol and its
> data structures.
> 
> The security considerations section has been done well.
> 
> The "short identifier" space consideration on page 34 might be
> problematic under extreme conditions.  If almost all values have
> been used, a set of nodes might cause trouble by constantly
> sending join requests.  The JRC(s) would have to time out their
> previous information, and there might be long delays before a
> short identifier could be freed up.  Perhaps there should be a rate
> limit on join requests from any single node.  (If there is such
> a limit I didn't see it).

On page 26, we define a parameter called “join rate” which sets the rate at which a Join Proxy (JP) forwards the requests on behalf of different pledges into the network. We discuss the use of join rate also in the Security Considerations section where I made the following change to stress the applicability of the parameter to the scenario you consider:
OLD: A data cap on the JP prevents it from forwarding more traffic than the network can handle.
NEW: A data cap on the JP prevents it from forwarding more traffic than the network can handle and enables throttling in case of an attack.
Please let me know if the existing and the amended text sufficiently clarifies the use of the join rate parameter.

> 
> Page 20 and page 23 mention "the user", but it is unclear what "user"
> means in this framework.

OLD: ...the (6LBR) pledge SHOULD signal to the user the presence of an error condition,...
NEW: ...the (6LBR) pledge SHOULD signal the presence of an error condition,...

> 
> Page 34 says that "the loss of security properties is eminent".  That
> intended word was probably "imminent".  I suggest rephrasing.

Fixed.

> 
> Page 37 asks the reader to recall a "well-known" Bluetooth problem, but
> there is no citation for it.  Either document it or remove it.

Thanks, I removed this sentence as it wasn’t critical for the comprehension of the rest of the paragraph.

> 
> Hilarie Orman
>