Subject: Re: [manet] AODV QoS incompatible with IPSEC

From: Pekka Savola <[email-masked]>
Date: Thu, 18 Apr 2002 10:17:26 +0300 (EEST)

On Mon, 8 Apr 2002, Pete Sholander wrote:

> Pekka ... It's well-known the QoS signaling protocols typically require
> hop-by-hop security.  The ATM Forum's work on S-PNNI is one practical
> example.

I don't dispute this; as you note, I was complaining about the fact that 
AODV QoS draft does not mention this "well-known fact"; the security 
considerations are not the same as with AODV, as stated in the draft.

> >>> Pekka Savola <[email-masked]> 04/07/02 11:00AM >>>
> Hi,
> 
> I just glanced through a summary of QoS for AODV and noticed the
> following in draft-perkins-manet-aodvqos-00.txt:
> 
> --8<--
> 5. Security Considerations
> 
>    This draft specifies mechanisms for handling quality of service.  It
>    does not introduce any special security considerations which were not
>    already present in the AODV routing protocol [2].
> --8<--
> 
> This is untrue, because:
> 
> --8<--
>    Before forwarding the RREQ, an intermediate node MUST compare its
>    NODE_TRAVERSAL_TIME to the (remaining) Delay indicated in the Maximum
>    Delay Extension.  If the Delay is less, the node MUST discard the
>    RREQ and not process it any further.  Otherwise, the node subtracts
>    NODE_TRAVERSAL_TIME from the Delay value in the extension and
>    continues processing the RREQ as specified in [2].
> 
> [...]
> 
>    Before forwarding the RREQ, an intermediate node MUST compare its
>    approximate jitter to the (remaining) Jitter indicated in the Maximum
>    Jitter Extension.  If the Jitter is less, the node MUST discard the
>    RREQ and not process it any further.  Otherwise, the node subtracts
> --8<--
> (note subtract above)
> 
> Intermediate nodes modifying the packet for all practical purposes kills 
> IPSEC except for an keys-shared-by-everyone method (only one applicable to 
> e.g. DSR I think).
> 
> IPSEC (to secure the routing messages) seems to be possible with AODV, but
> not with AODV QoS extensions.
> 
> 

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Pekka Savola <[email-masked]>
Date: Thu, 18 Apr 2002 10:17:26 +0300 (EEST)