Subject: [manet] AODV QoS incompatible with IPSEC

From: Pekka Savola <[email-masked]>
Date: Sun, 7 Apr 2002 18:00:48 +0300 (EEST)

Hi,

I just glanced through a summary of QoS for AODV and noticed the
following in draft-perkins-manet-aodvqos-00.txt:

--8<--
5. Security Considerations

   This draft specifies mechanisms for handling quality of service.  It
   does not introduce any special security considerations which were not
   already present in the AODV routing protocol [2].
--8<--

This is untrue, because:

--8<--
   Before forwarding the RREQ, an intermediate node MUST compare its
   NODE_TRAVERSAL_TIME to the (remaining) Delay indicated in the Maximum
   Delay Extension.  If the Delay is less, the node MUST discard the
   RREQ and not process it any further.  Otherwise, the node subtracts
   NODE_TRAVERSAL_TIME from the Delay value in the extension and
   continues processing the RREQ as specified in [2].

[...]

   Before forwarding the RREQ, an intermediate node MUST compare its
   approximate jitter to the (remaining) Jitter indicated in the Maximum
   Jitter Extension.  If the Jitter is less, the node MUST discard the
   RREQ and not process it any further.  Otherwise, the node subtracts
--8<--
(note subtract above)

Intermediate nodes modifying the packet for all practical purposes kills 
IPSEC except for an keys-shared-by-everyone method (only one applicable to 
e.g. DSR I think).

IPSEC (to secure the routing messages) seems to be possible with AODV, but
not with AODV QoS extensions.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet