Subject: [secdir] Security review of draft-ietf-ospf-manet-or-01

From: Ran Canetti <[email-masked]>
Date: Fri, 2 Jan 2009 22:20:47 +0200 (IST)

*I have reviewed these documents as part of the security directorate's
   *ongoing effort to review all IETF documents being processed by the
   *IESG.  These comments were written primarily for the benefit of the
   *security area directors.  Document editors and WG chairs should treat
   *these comments just like any other last call comments.

The document describes extensions to OSPF for adapting it to deal with 
mobile ad-hoc networks (MANETs). In general, the document seems well 
thought out and detailed. However, some security concerns seem to have 
not been addressed. (In fact, the security considerations section is 
quite terse, with only 8 lines.) For instance:

* In MANETs practically anyone can be a router (or at least this is 
the philosophy, in order to maximize connectivity). This means that 
route and connectivity announcements can be trusted to a much lesser 
extent, and a network needs to have ways to recover from false 
attestations. Note that authentication provides only a very partial 
solution here, since a bad attestation can be 100% authentic, in the 
sense that it really came from the claimed (malicious) source.

* One of the stated motivations for extending OSPF is to provide a 
"seamless" connection between a wired network and a MANET. However, such a 
"seamless" connection might be a source for instability of the wired 
network, since the wireless part might be much less stable, and perhaps 
maliciously so. So it seems that curbs must be put in order to protect the 
stability of the wired part of the network.

* It might be hard to locate and disconnect an undesirable endpoint
(say, a bot, spammer or a DOS-attacker) when it comes from a MANET.

Hope this helps,
Ran
_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir