Subject: [manet] AB#1 Comments for WGLC draft-ietf-manet-nhdp-sec-threats-02

From: Abdussalam Baryun <[email-masked]>
Date: Mon, 8 Apr 2013 20:35:40 +0200

This message Author: Abdussalam Baryun
Classified: I-D Review

Reply to your WGLC request dated 25/03/2013
The I-D Reviewed By: Abdussalam Baryun (AB)         Dated: 08/04/2013
Reviewer Comment AB#1: Objective and Introduction
++++++++++++++++++++++++++++++++++++
Copyright Notice:
Copyright (c) 2012 IETF Trust and the person identified as the
message author. All rights reserved.
This message is to comment on the MANET WG work in progress I-D:
draft-ietf-manet-nhdp-sec-threats-02 [I-D], which means this message
may contain parts/texts of the I-D under review
====================================

[I-D] Abstract:
[I-D] This document analyses common security threats of the Neighborhood
Discovery Protocol (NHDP), and describes their potential impacts on
MANET routing protocols using NHDP.

AB>question> What is the meaning of *common* security threats?
Mentioned in the abstract,

AB>question> How can I define threats when I don’t know on which layer
NHDP[RFC6130] is located in router, is it in L4 or L3. Please define
that you concern with IP layer if it is the only you concern with.

[I-D] Section 1.Introduction:

[I-D] The information acquired by NHDP is used by other protocols, such as
OLSRv2 [OLSRv2] and SMF [RFC6621].

AB> please add> AODVv2 as reactive protocol using NHDP, not only proactive,

[I-D] As wireless radio waves can be captured as well as transmitted
by any wireless
device within radio range

AB>confused> not true, different antennas have different
waves/frequencies, please delete.

[I-D] The document analyses possible attacks and mis-configurations on
NHDP and outlines the consequences of such attacks/mis-configurations
to the state
maintained by NHDP in each router (and, thus, made available to
protocols using this state).

AB> I don’t think it makes full analyses for NHDP threats? Please see
threat analysis by Tsao et al (2013) [1].

AB> the doc should consider information exchanged attacks and network
attacks as well.

Section 2. Terminology:

AB> you don’t define *Threat*, and *Attack*, please do same definition
as threat analysis draft in ROLL WG (or refer to it).

[I-D] Compromised NHDP Router: An attacker, present in the network and
which generates syntactically correct NHDP control messages.
Control messages emitted by a Compromised NHDP router may contain
additional information, or omit information, as compared to a
control message generated by a non-compromized NHDP router located
in the same topological position in the network.

AB> you mention network position, or topological position, but why the
document ignores the network domain(s) (just topology), could the NHDP
threats affect the network domain policy/states? If not say so,

The Message-References:
[1] http://tools.ietf.org/html/draft-ietf-roll-security-threats-01

=======================================
This is not the last comment, still under process,

Regards
AB

---------------------------------------------------------------------------------------
This message is not sent to private email boxes, but sent to IETF
MANET mail box.
This message and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
This message is in compliance with the IETF regulations.
---------------------------------------------------------------------------------------

On 3/25/13, Stan Ratliff (sratliff) <[email-masked]> wrote:
> WG,
>
> I've re-started the WGLC on this document. There's a 2-week WGLC period,
> ending on April 8, 2013.
>
> Regards,
> Stan
> _______________________________________________
> manet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manet

---

From: Ulrich Herberg <[email-masked]>
Date: Mon, 8 Apr 2013 12:00:59 -0700

AB,

see my answer below (note my reply represents my individual opinion; I
don't claim to speak for the whole author group):

On Mon, Apr 8, 2013 at 11:35 AM, Abdussalam Baryun
<[email-masked]> wrote:
[...]
> may contain parts/texts of the I-D under review

I think the word is fairly clear. See
http://dictionary.reference.com/browse/common
(definition 4/5)

> that you concern with IP layer if it is the only you concern with.

That is given by RFC6130, which is running on the IP layer. I think
this is not a task of NHDP-sec-threats to define.

> AB> please add> AODVv2 as reactive protocol using NHDP, not only proactive,

AODVv2 has no normative reference to RFC6130. In many cases of AODVv2
deployments, I don't think that RFC6130 would be used (whereas it must
be used for OLSRv2 and SMF). I am against adding a reference. Anyway,
the sentence just lists some example protocols ("such as...").

> waves/frequencies, please delete.

I think that this is fairly clear; it's about contrasting
communication over cable vs wireless, where the access to the channel
is much easier, i.e., security threats can be exploited more easily
since there is no physical access protection (read: cable).

> AB> the doc should consider information exchanged attacks and network

I think that this is exactly what NHDP-sec-threats does; section 4
describes the possible exploits when using no protection of NHDP.
Section 5 outlines the consequences for protocols using NHDP.

> as threat analysis draft in ROLL WG (or refer to it).

The words "threat" and "attack" are pretty well known; I don't see any
reason why they are ambiguous. I don't see any reason to cite the ROLL
draft; why is that related in any way to NHDP? It describes security
threats to a completely different protocol.

> threats affect the network domain policy/states? If not say so,

I don't understand your point. What do you mean?

Best regards
Ulrich

---

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 05:52:41 +0200

Just prefered to mention that NHDP is useful for both manet routing
standards, because the threats is not about proactive or reactive, but
threats around NHDP and its informations uses.

AB

On 4/8/13, Christopher Dearlove <[email-masked]> wrote:
> On 8 Apr 2013, at 20:00, Ulrich Herberg wrote:
>>>
> Also, when an AODVv2 option or variant (AODVv2 is not final, so not clear
> which yet) uses NHDP, it is not acting as a purely reactive protocol, but
> has some proactive behaviour - its NHDP part in fact.

---

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 06:33:08 +0200

Hi Ulrich,

comments for the best of the draft,

> don't claim to speak for the whole author group):

I understand that,
> http://dictionary.reference.com/browse/common

I mean why common why not ALL threats, or the explaining the *Exploits
Allowed by the NHDP* as per the reference [2] I gave in my AB#2
message.

> this is not a task of NHDP-sec-threats to define.

I don't find that defined, but if so, does IP threats affect the NHDP threats?

> the sentence just lists some example protocols ("such as...").

Just I prefered showing that NHDP explains all its threats when used
by different MANET routings, if we explain one only then we don't
explain all threats.

> since there is no physical access protection (read: cable).

Please delete word *any* and change to *some*, because think it is not
clear to me,

> Section 5 outlines the consequences for protocols using NHDP.

I need analysis which was mentioned but not done. I mean what is
exploited by the NHDP messages and the NHDP IIB and NIB, don't see
much explaining about those information and the exploitation. Yes in
section 4 explains but in the point of view of the attacker, and no
possibility of malfunctions or other issues,
> threats to a completely different protocol.

In the I-D the titles of section make me feel that authors made;
threats = attacks, so I need that to be answered in the doc.

> I don't understand your point. What do you mean?

Is the NHDP threats affecting the network domains? as it was mentioned
in the RFC6130 the different deployments and low-value  WSN. Does
different deployments mean different NHDP threats.

Regards
AB

---

From: Stewart Bryant <[email-masked]>
Date: Tue, 09 Apr 2013 08:20:14 +0100

I respond somewhat out of contest to the radio systems
text below.

> device within radio range

I think the text should surely be

As radio signals can be received as well as transmitted
by any compatible wireless device within radio range

> waves/frequencies, please delete.

Hm, the antennas are normally the least discriminatory part of a
radio system.

Stewart

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 9 Apr 2013 00:31:50 -0700

Stewart,

On Tue, Apr 9, 2013 at 12:20 AM, Stewart Bryant <[email-masked]> wrote:
[...]
> by any compatible wireless device within radio range

Thanks, I think this sentence is better than the one in the draft. We
will update it.

Ulrich

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Tue, 9 Apr 2013 08:57:43 +0000

AB> you don't define *Threat*, and *Attack*

Personally, I would start with ISO 27000 which has:

=====
2.45
threat
potential cause of an unwanted incident, which may result in harm to a system or organization

2.4
attack
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of
an asset (2.3)

2.3
asset
anything that has value to the organization
NOTE There are many types of assets, including:
a) information (2.18);
b) software, such as a computer program;
c) physical, such as computer;
d) services;
e) people, and their qualifications, skills, and experience; and
f) intangibles, such as reputation and image.

2.18
information asset
knowledge or data that has value to the organization
=====

(The rules are that you may substitute in the definition, so attack may be parsed as "attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of anything that has value to the organization".)

[There is also an overlapping set of definitions in ISO 27032, but 27000 is more relevant here.]

I don't know if there are any RFCs that reference ISO 27000.

-- 
Christopher Dearlove
Senior Principal Engineer, Communications Group
Communications, Networks and Image Analysis Capability
BAE Systems Advanced Technology Centre
West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
Tel: +44 1245 242194 |  Fax: +44 1245 242124
[email-masked] | http://www.baesystems.com

BAE Systems (Operations) Limited
Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre, Farnborough, Hants, GU14 6YU, UK
Registered in England & Wales No: 1996687

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

---

From: Jiazi Yi <[email-masked]>
Date: Tue, 9 Apr 2013 11:52:53 +0200

I agree with Ulrich's reply. 

We can change 

>> device within radio range

to 

> by any compatible wireless device within radio range

It would be clearer. 

best

Jiazi

---

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 13:07:05 +0200

Hi Stewart,

The antennas are responsible for the radio range or coverage, there
are directional antennas as well, but range is a distance not region,

> by any compatible wireless device within radio range

Thanks that you agreed that the first text was not clear, so I spoted
that it was not true. I hove no objection to your text as it has same
of my meaning,

> Hm, the antennas are normally the least discriminatory part of a

What you mean by normally? however, if we read any antenna
communication book I don't think your above assumption is correct.
Please don't ignore the wrods *radio-range* in the I-D text, so who is
responsible for the radio range do you think? I know that there are
other discriminatory in the PHY layer other than antenna but not for
radio range.

AB

---

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 13:43:47 +0200

Hi Chris,

The I-D seems not to define physical attacks (my understanding), which
I was not sure of but [1] (mentioned in first AB#1 message) did
include, but I think your input is prefered to include in the I-D or
used,

AB

On 4/9/13, Dearlove, Christopher (UK) <[email-masked]> wrote:
> (The rules are that you may substitute in the definition, so attack may be
> parsed as "attempt to destroy, expose, alter, disable, steal or gain
> unauthorized access to or make unauthorized use of anything that has value
> to the organization".)
>

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Tue, 9 Apr 2013 12:12:41 +0000

I'm neither recommending that a reference is included or excluded, I'm just providing here where one good source of definitions. Whether to reference it is a judgement call as to what is considered widely known, and what isn't.

But that definition is not limited to physical attack.

-----Original Message-----
From: Abdussalam Baryun [mailto:[email-masked]] 
Sent: 09 April 2013 12:44
To: Dearlove, Christopher (UK)
Cc: manet
Subject: Re: [manet] AB#1 Comments for WGLC draft-ietf-manet-nhdp-sec-threats-02

----------------------! WARNING ! ----------------------
This message originates from outside our organisation,
either from an external partner or from the internet.
Keep this in mind if you answer this message.
Follow the 'Report Suspicious Emails' link on IT matters
for instructions on reporting suspicious email messages.
--------------------------------------------------------

Hi Chris,

AB

---

From: Stewart Bryant <[email-masked]>
Date: Tue, 09 Apr 2013 15:18:39 +0100

On 09/04/2013 12:07, Abdussalam Baryun wrote:
> What you mean by normally?
Apart from ceramic antennas such as those used in GPS receivers
antennas are normally much broader band than the front
end filters in the radio or the channel discrimination filters
further back in the receiver.

Of course it may be that you have some special type of broadband
receiver in mind here, where the two bandwidths are matched. I
was just responding to the implication in your comment that
antennas were the dominant frequency element in a receiver
system which would be quite unusual.

Stewart/G3YSX/AF6XD

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 9 Apr 2013 11:50:27 -0700

AB,

I think this discussion diverges from the point that the paragraph
makes. Really what the paragraph says is that security threats may be
easier to exploit in a wireless environment than in a wired scenario.
This does not mean that the security threats do not exist in the wired
Internet. Just that it may be a first obstacle for me to break into my
competitor's company building in order to plug my laptop into their
Ethernet, rather than just sitting in the coffee shop next to the
company connecting to their Wifi (and potentially having the time to
drink 10 Venti Cappuccinos while breaking into their network). I think
that Stewart's sentence makes that intention clearer.

Ulrich

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 9 Apr 2013 11:53:35 -0700

Thanks Chris for providing these links. My personal opinion is that
these words are fairly well-understand and used in probably every RFC
that contains a Security Considerations section (and therefore do not
need a reference).
AB, do you think that anywhere in the text any of these words is
wrongly used or ambiguous?

Ulrich

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 9 Apr 2013 12:10:41 -0700

AB,

On Mon, Apr 8, 2013 at 9:33 PM, Abdussalam Baryun
<[email-masked]> wrote:
[...]
> Allowed by the NHDP* as per the reference [2] I gave in my AB#2

Because we cannot know if we listed ALL threats that could potentially
exist. It may be that we overlooked one, or that a future threat may
be thought of (I assume that when MD5 was standardized, they would
have loved to know about the threat that led to its obsoletion)

> I don't find that defined, but if so, does IP threats affect the NHDP threats?

RFC6130 runs either on UDP or directly on IP (see section 5.1 of
RFC6130), and uses a multicast LL address (section 5.2). In multiple
occasions of the text in RFC6130 it is mentioned that either IPv4 or
IPv6 can be used. It is true that there is no sentence in the
beginning of RFC6130 "This is an IP protocol and all addresses used in
this specification are either IPv4 or IPv6 addresses". But whether or
not that would be a good idea to mention as clarification in RFC6130
is irrelevant because it's already completed.

[...]
> by different MANET routings, if we explain one only then we don't

As said above, we cannot assure to discuss *all* threats. I also don't
see how the draft would improve by citing AODVv2 here, as in its
current form, it does not mandate to use RFC6130. And AODVv2 is only a
-00 draft, so there could be many changes to it yet, so we don't even
know what will be included in it (whereas SMF and OLSRv2 are
completed).

> Please delete word *any* and change to *some*, because think it is not

See the other email and suggestion from Stewart.

> possibility of malfunctions or other issues,

I don't understand which attacks you would like to see in the draft.

> threats = attacks, so I need that to be answered in the doc.

I don't see how this would improve the draft. Anyone else thinking
this is a problem?

> different deployments mean different NHDP threats.

The draft describes potential threats to NHDP; whether they are always
feasible for an attacker cannot be answered in this document, I think
(and also irrelevant).

Ulrich