Subject: Re: [babel] [Homenet-babel-sec] Security Design Team - July is coming!

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 23 May 2017 19:00:36 +0200

CC-ing the Babel list, at least Matthieu is interested and not subscribed
to h-b-s.

> To be honest, I do not know where the discussion has landed at this
> point.  One of the key requirements for me to write any code is that
> there be a conclusion on how to do unicast hellos.

Ted, please assume that we (the Babel community) will do the Babel
security work in a reasonably timely manner.  What somebody needs to do is
work out the HNCP-related details, notably signalling the requirement for
auth on a given link and the authentication keys.

> Can anybody else on the team talk about what's going on there?

Will reply to David's mail.

-- Juliusz

---

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 23 May 2017 19:05:04 +0200

> 1) The community agrees that we want to support them

I think there's a fair number of people who are.  I, for one, would like
to see them defined, although I'm not sure if they are really necessary --
I don't see an attack model that targets Hellos specifically.

> 2) The community hasn't yet come to a consensus on how to encode them,
> proposals included a new TLV, a flag in the existing TLV, and a sub-TLV.

I don't think we considered sub-TLVs, although this might be an option now
that we have mandatory bits.

> While the Homenet Babel profile could technically be achieved without
> unicast hellos, I think they expand our options, and since they are at the
> top of the Babel WG's agenda, it's worth waiting for them.

Agreed.

Antonin Décimo (in copy of this mail) will be doing an internship on Babel
this July.  The plan is to have him implement a prototype of
Stenberg-Schinazi security for Babel (unicast everything, protect using
DTLS).

My current plan is to ask him to do without unicast Hellos for now (this
means that Hellos will be unprotected), although it's up to Antonin --
perhaps he'll want to work on unicast Hellos first.

-- Juliusz

---

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 23 May 2017 19:09:09 +0200

> I think we were waiting for proponents of each alternative to write code.

Oh, I missed this bit.

I was going to bully everyone into working on that, but then Gwendoline
and Matthieu convinced me to add mandatory bits to the spec, so I've been
working on that, as I'd like the mandatory bits work to be ready before we
introduce more changes.

FWIW, mandatory bits are implemented in both babeld and sbabeld, and I've
got the spec written down.  Unfortunately, I did it in an obsolete git
branch, so I need to do some merging and wordsmithing before I can push.
(Automatic git merges on natural language documents are not quite reliable.)

-- Juliusz

---

From: Jehan Tremback <[email-masked]>
Date: Tue, 23 May 2017 11:55:09 -0700

Hey, I just read through the minutes, wondering if someone has a concise
definition of the threat model we are trying to guard against. I assume
it's to prevent attackers from showing up and sending out bogus routing
messages to bork or DOS the network?

-Jehan

On Tue, May 23, 2017 at 10:09 AM, Juliusz Chroboczek <[email-masked]> wrote:

> _______________________________________________
> Homenet-babel-sec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet-babel-sec
>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 23 May 2017 15:01:08 -0400

> auth on a given link and the authentication keys.

Okay, thanks, that's good feedback.   I will focus on that.

---

From: Ted Lemon <[email-masked]>
Date: Tue, 23 May 2017 15:04:02 -0400

On May 23, 2017, at 2:55 PM, Jehan Tremback <[email-masked]> wrote:
> Hey, I just read through the minutes, wondering if someone has a concise definition of the threat model we are trying to guard against. I assume it's to prevent attackers from showing up and sending out bogus routing messages to bork or DOS the network?

I don't think it's necessarily going to be possible to _prevent_ attackers from showing up and sending out bogus routing messages.   However, what we probably _can_ do is to be able to know which router sent which update, so that we can see, if there is an attack, where it is coming from.

It would be good to game this out more, though.   We had a pretty good discussion in the meeting, and I think I sent out a summary message about it afterwards, but we haven't gone past that.

---

From: Ted Lemon <[email-masked]>
Date: Tue, 23 May 2017 15:06:51 -0400

> Hey, I just read through the minutes, wondering if someone has a concise definition of the threat model we are trying to guard against. I assume it's to prevent attackers from showing up and sendin…

Here are the notes that we took in the break-out session after the main meeting:

https://github.com/bhstark2/babel-security/blob/master/chicago-notes.md <https://github.com/bhstark2/babel-security/blob/master/chicago-notes.md>

There's also a file there where we were going to put in our thoughts about the threat model, so that we could try to come up with an idea of what we are all talking about.   However, it looks like nobody's actually done anything to that document.

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Wed, 24 May 2017 17:37:46 +0000

> https://github.com/bhstark2/babel-security/blob/master/chicago-notes.md 

Please let me know if I should add anyone to this github.
BTW, I'm on vacation this week and will not be particularly responsive during this time.
Barbara