Subject: [manet] AODV QoS incompatible with IPSEC

From: Pekka Savola <[email-masked]>
Date: Sun, 7 Apr 2002 18:00:48 +0300 (EEST)

Hi,

I just glanced through a summary of QoS for AODV and noticed the
following in draft-perkins-manet-aodvqos-00.txt:

--8<--
5. Security Considerations

   This draft specifies mechanisms for handling quality of service.  It
   does not introduce any special security considerations which were not
   already present in the AODV routing protocol [2].
--8<--

This is untrue, because:

--8<--
   Before forwarding the RREQ, an intermediate node MUST compare its
   NODE_TRAVERSAL_TIME to the (remaining) Delay indicated in the Maximum
   Delay Extension.  If the Delay is less, the node MUST discard the
   RREQ and not process it any further.  Otherwise, the node subtracts
   NODE_TRAVERSAL_TIME from the Delay value in the extension and
   continues processing the RREQ as specified in [2].

[...]

   Before forwarding the RREQ, an intermediate node MUST compare its
   approximate jitter to the (remaining) Jitter indicated in the Maximum
   Jitter Extension.  If the Jitter is less, the node MUST discard the
   RREQ and not process it any further.  Otherwise, the node subtracts
--8<--
(note subtract above)

Intermediate nodes modifying the packet for all practical purposes kills 
IPSEC except for an keys-shared-by-everyone method (only one applicable to 
e.g. DSR I think).

IPSEC (to secure the routing messages) seems to be possible with AODV, but
not with AODV QoS extensions.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 18 Apr 2002 08:25:06 -0700

> IPSEC except for an keys-shared-by-everyone method (only one applicable to

Maybe IPsec won't be a good solution for ad hoc networking protocols.
It seems to be totally inflexible, and we need more flexibility.

> not with AODV QoS extensions.

Whether or not this is true, the argument about QoS should not have
any effect.

If you claim that AODV with QoS is less secure than AODV, for the reason
that useless messages MUST be discarded, then I think that you must
be using a wrong model of security to start with.

Regards,
Charlie P.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 18 Apr 2002 08:25:06 -0700

Regards,
Charlie P.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 19 Apr 2002 00:45:06 +0300 (EEST)

> It seems to be totally inflexible, and we need more flexibility.

Perhaps, perhaps not.  That's not the point.
 
> be using a wrong model of security to start with.

One particular (and probably the only currently viable) mechanism is to 
use IPSEC. (Please don't mention IEEE 802.11 :-).

I'm not discussing security models here, I'm arguing against the wording 
which is basically "AODV QoS does not make security any more difficult 
and creates no new problems".  

This is clearly false, especially in the light that AODV messages are
recommended to be authenticated etc. (AODV QoS may or may not make it more
difficult, depending on the mechanism; probably will) considering the
limited scope of current mechanisms of securing AODV.

The wording in the main AODV draft makes one assume that it is probably
talking about protecting the data packets, not AODV.  But as IPSEC was
mentioned there, one would usually assume it could be used to some extent
with AODV packets too.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 19 Apr 2002 00:45:06 +0300 (EEST)

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 18 Apr 2002 15:07:49 -0700

> and creates no new problems".

But I didn't yet see what the new problem is...

> limited scope of current mechanisms of securing AODV.

How does one resolve "clearly false" with "may or may not make it
more difficult"?

> mentioned there, one would usually assume it could be used to some extent

I'd like to take a look at this.  I don't remember any place
in the AODV draft that was intended to discuss securing data
packets.  If you can point to these places, or better yet suggest
ways of removing the confusing, that would be helpful.

Regards,
Charlie P.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 18 Apr 2002 15:07:49 -0700

Regards,
Charlie P.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 19 Apr 2002 11:24:36 +0300 (EEST)

> How does one resolve "clearly false" with "may or may not make it

Basically the only real securing mechanism for something like this today 
is IPSEC.  Unless otherwise stated, it's IMO fairly safe to assume it 
would be used.
 
> ways of removing the confusing, that would be helpful.

Security Considerations say:
--8<--
   Since AODV does not make any assumption about the nature of the
   address assignment to the mobile nodes except that they are presumed
   to have unique IP addresses, no definite statements can be made about
   the applicability of IPsec authentication headers or key exchange
   mechanisms.  However, if the mobile nodes in the ad hoc network have
   pre-established security associations, they should be able to use the
   same authentication mechanisms based on their IP addresses as they
   would have used otherwise.
--8<--

I assumed that this applies to the data packets, as otherwise it would be 
wrong: due to Hop Count and such, which may be modified in transit, IPSEC 
would not be all that usable to secure AODV control packets without 
further elaboration.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 19 Apr 2002 11:24:36 +0300 (EEST)