Re: [Drip] -auth issues/comments

[Stu Card <[e-mail]>]

The response from ODID on #38 was merely that repetition, within latency limits, is not _prohibited_. That does not make it a good idea. Specifically, the ODID response does not consider potential impact on tracking algorithms.


Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: Adam Wiethuechter <[e-mail]>
Sent: Monday, July 31, 2023 8:47:36 PM
To: Stu Card <[e-mail]>; [e-mail] <[e-mail]>
Cc: [e-mail] <[e-mail]>; Eric Vyncke (evyncke) <[e-mail]>
Subject: Re: -auth issues/comments

I already posted the 5 issues to the list for comments [1] with only a single response from Stu. Thanks for bring this back up to the top of the stack.

Bob has commented on Issue #35 (on GitHub itself) saying what is there is fine, perhaps a bit string or hex representation can be added to avoid any errors. Also, a comment from Bob on the informational note to be clearer.

I got a response for Issue #38 [2] from ODID.

[1] https://mailarchive.ietf.org/arch/msg/tm-rid/ct1i7y0RxMg2axhsCMXkxMMOh_0/
[2] https://github.com/opendroneid/opendroneid-core-c/issues/71

--------
73,
Adam T. Wiethuechter
Software Engineer; AX Enterprize, LLC
________________________________
From: Stu Card <[e-mail]>
Sent: Monday, July 31, 2023 11:19 AM
To: [e-mail] <[e-mail]>
Cc: [e-mail] <[e-mail]>; Eric Vyncke (evyncke) <[e-mail]>
Subject: -auth issues/comments


There are 5 GitHub issues still open.



Most don’t even have any comments from anyone other than primary author Adam.



Issue #35 is the cSHAKE string. Bob?



Issue #36 is 1st manifest’s “previous” hash value. Choice 5, random nonce,  makes the start of the sequence unpredictable, giving attackers less time to brute force a forged signature on a bogus manifest forking the chain. Bob?



Issue #38 is duplicating or updating messages when transmitting at a higher rate than required by the rules. My preference is to avoid duplicate transmissions of the same data, as such would require filtering on the receive end to avoid confusing tracking algorithms: just processing dots would make it look like a moving aircraft was hovering for a second, then teleporting to the next location, then hovering for a second, then teleporting. Of course, the filtering would be trivial, as Location/Vector messages have time stamps. Tracking would still be improved by more frequently updated data. I don’t remember what the implementation difficulties might be. Adam?



Issue #39 is the SAM code points. We believe we are getting 1 through 4 inclusive, but do not have official confirmation. Bob says Eric says he is hopeful for August.



Issue #41, Adam has reported as fixed in a commit to -auth-31, which will not be uploaded to the Datatracker until more (hopefully all) of the above are resolved.



We should ensure that this draft is otherwise 100% ready to go now, before we receive official confirmation of our SAM codes, so…



I strongly encourage everyone to review the 2 area director reviews in the Datatracker (which were of a much earlier version) and current version -30.



Thanks!



-- Stu