Subject: [secdir] SECDIR review of draft-ietf-manet-nhdp-sec-threats-04

From: Matthew Lepinski <[email-masked]>
Date: Mon, 10 Jun 2013 00:13:25 -0400

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This document provides a taxonomy of attacks against the Mobile Ad Hoc
Network Neighborhood Discovery Protocol (NHDP) [RFC 6130]. The document
also contains a discussion of the impact of these attacks on running on top
of NHDP (in particular, OLSRv2 and SMF)

Having reviewed the document, I do not see substantial issues in the
document. I believe it is reasonable to publish as an informational RFC.

*One minor issue:* The replay attack described in Section 4.5 did not seem
substantially different than the attacks described in Section 4.4. It is
not clear to me how replaying a message from another part of the network is
any worse (or substantially different) than just fabricating a message
claiming connectivity that does not exist (i.e., like what is described in
4.4.2). I would recommend either deleting 4.5 or else clarifying how these
attacks are substantially different.

*Trivial nit:* In Section 5, "a Compromised NHDP router will seek to
manipulate" -- substitute "may seek" instead of "will seek". We don't know
for certain what a compromised router will do (unless one assigns clear
motivation to the adversary, which this document does not).

---

From: Jiazi Yi <[email-masked]>
Date: Tue, 11 Jun 2013 10:52:58 +0200

Dear Matthew, 

Thanks for your review of the draft. Please check the reply inline:

On Jun 10, 2013, at 06:13 , Matthew Lepinski <[email-masked]> wrote:

> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
> 
> This document provides a taxonomy of attacks against the Mobile Ad Hoc Network Neighborhood Discovery Protocol (NHDP) [RFC 6130]. The document also contains a discussion of the impact of these attacks on running on top of NHDP (in particular, OLSRv2 and SMF)
> 
> Having reviewed the document, I do not see substantial issues in the document. I believe it is reasonable to publish as an informational RFC.
> 
> One minor issue: The replay attack described in Section 4.5 did not seem substantially different than the attacks described in Section 4.4. It is not clear to me how replaying a message from another part of the network is any worse (or substantially different) than just fabricating a message claiming connectivity that does not exist (i.e., like what is described in 4.4.2). I would recommend either deleting 4.5 or else clarifying how these attacks are substantially different.

The main difference between 4.4 and 4.5 is that reply attack is based on manipulating the transmission channel, while Incorrect HELLO message generation is based on wrong HELLO message. 
We proposed more text to describe the difference in the end of section 4.5:

==
Compared to Incorrect HELLO Message attacks described in Section 4.4, the messages used in Replay attack are legitimate messages sent out by (non-malicious) NHDP routers and replayed at a later time or different locality by malicious routers. This makes this kind of attack harder to be detect and to counteract: integrity checks cannot help in this case as the original message ICV was correctly calculated.
====

If you are OK with the text, we will add it to the next revision. 

> 
> Trivial nit: In Section 5, "a Compromised NHDP router will seek to manipulate" -- substitute "may seek" instead of "will seek". We don't know for certain what a compromised router will do (unless one assigns clear motivation to the adversary, which this document does not).

Yes, will be corrected in the next revision :)

thanks again

best

Jiazi

---

From: Matthew Lepinski <[email-masked]>
Date: Tue, 11 Jun 2013 13:38:27 -0400

Thank you, I found that clarification helpful.

Also, as I indicated, I think the document is quite good. I think it
valuable to document the attacks that can be preformed by a compromised
device in a manet and the impact on the network. (Although, I am mostly
left thinking ... Wow, compromising a routing in an ad hoc network is just
really, really bad :-< )

On Tue, Jun 11, 2013 at 4:52 AM, Jiazi Yi <[email-masked]> wrote:

> > I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
>  These comments were written primarily for the benefit of the security area
> > One minor issue: The replay attack described in Section 4.5 did not seem
> The main difference between 4.4 and 4.5 is that reply attack is based on
> manipulating the transmission channel, while Incorrect HELLO message
> generation is based on wrong HELLO message.
> Compared to Incorrect HELLO Message attacks described in Section 4.4, the
> messages used in Replay attack are legitimate messages sent out by
> (non-malicious) NHDP routers and replayed at a later time or different
> locality by malicious routers. This makes this kind of attack harder to be
> detect and to counteract: integrity checks cannot help in this case as the
> original message ICV was correctly calculated.
> ====
>
> > Trivial nit: In Section 5, "a Compromised NHDP router will seek to