Re: [smartpower-interest] Looking for references/pointers to security research on wireless ad-hoc networks

[Hector <[e-mail]>]

Depending on what packet mechanism he can settle with, a RFC5322-based 
payload using self-signed DKIM signatures with ADSP exclusive 
self-signed policy declarations will work by first addressing fault 
detection (policy violations) requirement.  What remains is valid 
authenticated payloads.

The trust is another matter as you pointed out.  Strict DKIM has been 
remodeled for a minimum layered single identity trustconcept, abeit 
3rd party certification.

That's been the long central contentious issue in DKIM working group - 
POLICY vs TRUST.  My position is that you need both. Filter the 
violations first and that includes policies to exclude 3rd party 
signers or authorize them.  Extensions for ADSP has been written to 
support authorized signers.

Without having a central entity is some what more difficult (i.e. DNS, 
public key location, etc) requiring some P2P networking knowledge. 
"Something" has to be shared.  I can imagine if this is private 
network of devices, the vendor will be the central trust identity.

   DomainKeys Identified Mail (DKIM) Signatures
   RFC4871 http://tools.ietf.org/html/rfc4871

   DKIM Author Domain Signing Practices (ADSP)
   RFC5617 http://datatracker.ietf.org/doc/rfc5617/

   DKIM Authorized Third-Party Signers  (ADSP extension I-D)
   http://datatracker.ietf.org/doc/draft-kucherawy-dkim-atps/

We are going to be using DKIM to assist in private mail networks 
first, external networking second with strong support for the 
deterministic nature of ADSP secured DKIM payloads.  This was outlined 
in my I-D:

   DKIM Signature Authorization Protocol (DSAP)
   http://tools.ietf.org/html/draft-santos-dkim-dsap-00

-- 
Hector Santos, CTO
http://www.santronics.com

Greg Daley wrote:
> Hi Akyol, 
> 
> This sort of issue associated with authorization without a central authority is similar to other works
> on peer-to-peer networking, without centralized authentication service.
> 
> The question is whether trust has been established previously (and we are recovering based on known 
> relationships) or trust has never been present.
> 
> In the second case, it may be impossible to establish trust because of the low cost associated with
> creation of fake identities on the wireless medium (Even with some sort of agreement protocol, it may
> be possible to overwhelm the network using the unfortunately named Sybil attack).
> 
> In the first case, it may be possible to establish the identity of a peer by establishing common trust using
> common trust relationships (back to a known source, perhaps using Certificates). 
> 
> Albeit this may be subject to attacks where the certified identity is compromised, and the existing connectivity
> to a CRL or online Certificate validity server (using for example OCSP) is overwhelmed.
> 
> Another approach is to provide authentication via existing connected nodes back to the centralized site, but
> using protections back to the central server.  I believe this may be covered by an independent submission
> that is still being discussed on the (concluded) PANA Working group  mailing list.
> 
> http://www.ietf.org/mail-archive/web/pana/current/maillist.html
> 
> Sincerely,
> 
> Greg Daley
> Consultant
> Logicalis Australia Pty Ltd
>   	 
> E: [e-mail]
> M: [phone]
> P: [phone]
> F: [phone]
>  
> 
>> -----Original Message-----
>> From: [e-mail] 
>> [mailto:[e-mail]] On Behalf Of 
>> Akyol, Bora A
>> Sent: Tuesday, 26 April 2011 2:18 AM
>> To: [e-mail]
>> Subject: [smartpower-interest] Looking for 
>> references/pointers to security research on wireless ad-hoc networks
>>
>>
>> Hi everyone.
>>
>> After doing the mandatory literature searches on IEEE, ACM 
>> and Google Scholar, I am looking to see if I have missed
>> any ongoing work at IETF regarding authorization and 
>> authentication of devices or software in wireless ad-hoc 
>> networks where
>> a centralized entity may not exist. Note that I am not 
>> looking for work on routing in MANET or encryption technologies.
>>
>> This is related to ongoing smart grid work that I am doing.
>>
>> Thank you very much for your help,
>>
>> --
>> Bora Akyol, Pacific Northwest National Laboratory
>> [phone], [e-mail]<mailto:[e-mail]>, www.pnnl.gov
>> _______________________________________________
>> smartpower-interest mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/smartpower-interest
>>
> _______________________________________________
> smartpower-interest mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/smartpower-interest