Subject: [Roll] security for multi-link subnets

From: Michael Richardson <[email-masked]>
Date: Tue, 12 Mar 2013 14:20:23 -0400

It was pointed out in a private discussion that the inclusion of
security parameters in the ROLL applicability statements might be
surprising to some.  For those who want a quick look:
  http://datatracker.ietf.org/doc/draft-ietf-roll-applicability-template/
  http://datatracker.ietf.org/doc/draft-ietf-roll-rpl-industrial-applicability/
  http://datatracker.ietf.org/doc/draft-brandt-roll-rpl-applicability-home-building/

Specifically, people wouldn't not normally think to look at
applicability statements for a routing protocol to see that it is
specifying not just security parameters for the routing protocol 
itself, but in some cases, requirements on access to the LLN as well.

I agreed that perhaps this needed additional socialization, which I'm
trying to do with this email.

Some of my logic of what we are doing is that by (securely) assembling
a bunch of links into a multi-link subnet, that in effect the ROLL
applicability statements are in effect a kind of IP-over-FOO document.

To parallel it to other IP-over-FOO documents better, they often specify
things like how to encapsulate, and how to do address resolution on the
subnet. 

RPL LLNs do not use stock-ND/ARP (which normally would be specified in an
IP-over-FOO document), but rather use the RPL messages to discover other
nodes on the subnet.     I have asked that the applicability statements
be clear about if they use RFC6775 (6lowpan-ND), and if so, how. 

It was suggested really, we never did that before: specify security of
the network in IP-over-FOO documents.  Well, that's true, because we
never did a an IP-over-802.11, because it was ethernet.

When WIFI's various incarnations happened (remember borrowing 2Mb/s *FH*
wireless PCICIA cards back at IETF46?), they tried hard to make it look
like ethernet, with ethernet-like physical security (WEP == "Wired Equivalent
Privacy").  It's too bad that we didn't get more involved at the time,
in the end, we did EAP and keyprov in great part to get that part done
right.  I still think that the 802.11 security is largely a disaster. 

It is possible that the problem is the word "applicability", and perhaps
we should have a different term.  I would welcome discussion here, or
even just +1 that this is the right approach.

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works 
IETF ROLL WG co-chair.    http://datatracker.ietf.org/wg/roll/charter/

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 12 Mar 2013 14:31:44 -0400

Michael,

I think it is also worth mentioning RFC4903, in particular:

"A multi-link subnet model should be avoided.  IETF working groups
   using, or considering using, multi-link subnets today should
   investigate moving to one of the other models."

Have the issues mentioned in RFC4903 been sufficiently addressed?

Best regards
Ulrich

On Tue, Mar 12, 2013 at 2:20 PM, Michael Richardson
<[email-masked]> wrote:
> _______________________________________________
> Roll mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/roll
>

---

From: Michael Richardson <[email-masked]>
Date: Tue, 12 Mar 2013 15:46:05 -0400

>>>>> "Ulrich" == Ulrich Herberg <[email-masked]> writes:
    Ulrich> I think it is also worth mentioning RFC4903, in particular:

    Ulrich> "A multi-link subnet model should be avoided.  IETF working groups
    Ulrich> using, or considering using, multi-link subnets today should
    Ulrich> investigate moving to one of the other models."

    Ulrich> Have the issues mentioned in RFC4903 been sufficiently addressed?

I think that if we were going supposed to avoid a multi-link subnet,
that would have been objected to already.  
I think that 4903 concerns applied to all of 6lowpan and ROLL work, and
I think that actually we did deal with all of these.

-- 
Michael Richardson
-on the road-

---

From: Don Sturek <[email-masked]>
Date: Tue, 12 Mar 2013 12:58:44 -0700

Hi Michael (and Ulrich),

The area that I think needs more work around the multi-link subnets topic
is the scope for site-local addresses.

Since link locals are not that useful in multi-link subnets (routing wise)
and not all devices in a 6LoWPAN/ROLL environment may want global
addresses even if such a prefix were available, clear scoping rules (eg,
routing, multicast propagation) on site local addresses is a major topic.
If someone knows of an RFC (or even a draft) that starts to address the
issue of identifying site local versus non-site prefixes/interfaces, that
would be interesting.  This topic is especially interesting in deployments
with multiple prefixes (like that now being discussed in Homenet) as well
as campus type environments.

I also bring this up (on purpose) under the topic of "security for
multi-link subnets" since turning on link security does not help securing
these networks.......

Don

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 12 Mar 2013 16:36:06 -0400

Michael,

On Tue, Mar 12, 2013 at 3:46 PM, Michael Richardson
<[email-masked]> wrote:
> [...]

I must have missed that discussion. Can you please point me to where
and how the issues have been solved, and why the advice of RFC4903 to
not use multi-link subnets does not apply to LLNs / to RPL?

Thanks
Ulrich