Subject: [babel] MAC auth. for Babel in babeld

From: Antonin Décimo <[email-masked]>
Date: Thu, 20 Aug 2020 12:35:31 +0200

Dear all,

I’ve rolled up my sleeves and finished my implementation of the MAC
authentication protocol in babeld.

It can be found on the branch "hmac" in

    https://github.com/MisterDA/babeld.git

Or on the opened pull-request in the main repository at

    https://github.com/jech/babeld/pull/52

There is one bug that I’m aware of: sometimes the local configuration
interface will respond "bad", letting the user think that there was an
error during the parsing or the processing of the configuration, but
everything happened correctly.

There is one feature that I have not implemented (yet): expiring
per-neighbour state (section 4.4) using the Hello history or a timer
based on the last accepted packet.

The code has not undergone review. No interoperability testing has
been done.

I’m also looking for feedback on the user interface. Here follows the
manual page describing the new configuration options (underscores
indicate user defined values).

In particular, do you think that implementing keysets and allowing an
unbounded number of keys is too much for babeld?

Key rotation is done through the local configuration interface.

   MAC authentication for the Babel routing protocol
       This protocol provides basic security properties for the Babel
       routing protocol. The scope of this protocol is strictly
       limited: it only provides authentication (we assume that
       routing information is not confidential), it only supports
       symmetric keying, and it only allows for the use of a small
       number of symmetric keys on every link.

       Keys and keysets are reference-counted. They are discarded as
       soon as they are no longer referenced.

       Interface configuration

           mac {true|false}
                  Enable MAC security on this interface.

           mac-verify {true|false}
                  Check packet signatures, reject unsigned or
                  incorrectly signed packets. The default is true.

           add-keyset _keyset-name_
                  Add the keyset _keyset-name_ to the set of keysets
                  of this interface.

           rm-keyset _keyset-name_
                  Remove the keyset _keyset-name_ from the set of
                  keysets of this interface.

       Global options

           key name _name_ algorithm {hmac-sha256|blake2s} value
           _value_ use {sign|verify|both}
                  Configure a key for use with the mac interface
                  option. The algorithm is either hmac-sha256 or
                  blake2s. The value is a hexadecimal string (up to 64
                  bytes for hmac-sha256 or up to 32 bytes for
                  blake2s). The use specifies whether the key is used
                  to sign packets, verify packets, or both (signing
                  and verifying packets).

           keyset _name_
                  Create an empty keyset.

           keyset-add-key _keyset-name_ _key-name_
                  Add the key _key-name_ to the keyset _keyset-name_.

           keyset-rm-key _keyset-name_ _key-name_
                  Remove the key _key-name_ from the keyset
                  _keyset-name_.

Thanks!

-- Antonin

---

From: Juliusz Chroboczek <[email-masked]>
Date: Thu, 27 Aug 2020 15:13:56 +0200

> authentication protocol in babeld.

Excellent!  I'll get to work on reviewing that as soon as teaching is
under control.  (In case anyone is interested -- we've got a lot of
COVID-related restrictions, which I happen to support, but we're getting
very little help with implementing them.  I'm down to buying my own masks
to distribute to students who forget theirs.)

> based on the last accepted packet.

Yes, you have :-)

The per-neighbour state is attached to the neighbour entry, and the
neighbour entry will be discarded soon after the hello history becomes
empty.  See the function check_neighbours in neighbour.c, which is called
periodically by the main loop.

> The code has not undergone review. No interoperability testing has

Please find out if you're allowed to enter the office (not obvious due to
COVID).  If not, I'll ask the boss for permission, or else we'll meet at
my place.

> I’m also looking for feedback on the user interface.  [...]  In
> particular, do you think that implementing keysets and allowing an

As a general rule, I'm in favour of reflecting the implementation details
in the user interface to the extent possible -- if you don't do that, the
interface becomes confusing to the user who cannot build an accurate
mental model of what's going on.  If that's too complicated, I'd rather we
add some macros than dumb down the interface.  (Commands that expand to
a sequence of lower-level commands.)

You should consider what happens to your code when there are too many
keys, and the MACs no longer fit in a packet.  A silent failure would be
bad.

-- Juliusz

---

From: Juliusz Chroboczek <[email-masked]>
Date: Thu, 27 Aug 2020 15:16:29 +0200

>> authentication protocol in babeld.

Did I say thanks?  I think I didn't say thanks.

Thanks, Antonin.

-- Juliusz

---

From: Antonin Décimo <[email-masked]>
Date: Fri, 28 Aug 2020 22:41:11 +0200

Another thing that could be added: a separate table for uncompleted
challenges (see en paragraph of section 7).

> > based on the last accepted packet.

Well that’s a relief!

> Please find out if you're allowed to enter the office (not obvious
> due to COVID). If not, I'll ask the boss for permission, or else
> we'll meet at my place.

You’ll have to invite me to allow me to enter the premises 🧛

> As a general rule, I'm in favour of reflecting the implementation
> details in the user interface to the extent possible -- if you don't
> do that, the interface becomes confusing to the user who cannot
> build an accurate mental model of what's going on.

After some failed attemps, I had started the other way around and
designed the most complete user interfacte I could think of, and then
build the implementation to match that model.

>  If that's too complicated, I'd rather we add some macros than dumb
> down the interface. (Commands that expand to a sequence of
> lower-level commands.)

Hmm, nice idea. We could have a single keyset of two key slots, shared
by all interfaces, with the simplest user interface. We can have a
pre-configured timer for key rotation during which both keys would be
available.

    interface default mac true
    rotate-key hmac-sha256 0000
    …
    rotate-key hmac-sha256 1111

It’s not clear right now how the 'complete' and the 'simple' interface
could be used in the same time, but that is absolutely workable.

> keys, and the MACs no longer fit in a packet. A silent failure would be

The packet is not send. There are two error messages. The buffer is
discarded.

-- Antonin