Subject: Re: [secdir] Assignment: draft-ietf-ospf-manet-mdr-04

From: "Uri Blumenthal" <[email-masked]>
Date: Mon, 12 Jan 2009 09:49:19 -0500

I've reviewed this draft (draft-ietf-ospf-manet-mdr-04). Its Security
Considration section basically states "This is OSPFv3 extension and can use
the same IPv6 security mechanisms as OSPFv3. No new security concerns."

I know way too little of OSPF to meaningfully evaluate this statement. My
intuition however says that mobility and Ad-Hoc-ness probably do introduce
issues. 

For example, OSPFv3 Auth (RFC 4552) says that for multicast manual keying
should be used for now, and KINK can be explored in the future. This
extension uses multicast (section 2.3). How the keying would be done is
unclear to me, and I wouldn't be very happy to hear "manually" in response
(for an Ad-Hoc network!).

Overall, I would like to see some kind of analysis and/or explanation of how
the new features do not introduce any new threats and thus raise no new
concerns. For example, are malicious entities a concern (shouldn't they
be?)? Again, I don't know OSPF enough to do that analysis myself.

Also, it speaks of OSPFv3 but refers to OSPFv2 (RFC 2328).

Tnx!

_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir