Subject: [manet] DLEP-18 Security Considerations

From: Stan Ratliff <[email-masked]>
Date: Mon, 18 Jan 2016 19:51:06 -0500

Hello WG,

As requested in the email thread earlier today, here's a snapshot of what
we currently have in the upcoming DLEP-18 draft wrt security. We've put an
additional paragraph in the Assumptions section (Sec. 2.1) that says:

   The reliance on MAC addresses by DLEP forces the assumption that
   participating DLEP peers are on a single segment (either physical or
   logically, via tunneling protocols) at Layer 2.  DLEP further assumes
   that security of the implementations (e.g., authentication of
   stations, encryption of traffic, or both) is dealt with by by
   utilizing Layer 2 security techniques.

Additionally, here is the text in the "Security Considerations":

12.  Security Considerations

   The potential security concerns when using DLEP are:

   1.  An attacker might pretend to be a DLEP peer, either at DLEP
       session initialization, or by injection of messages once a
       session has been established, and/or

   2.  DLEP data items could be altered by an attacker, causing the
       receiving implementation to inappropriately alter its information
       base concerning network status.

   Since DLEP is restricted to operation over a single (possibly
   logical) hop at layer 2, implementations requiring authentication
   and/or encryption of traffic MUST take steps to secure the Layer 2
   link.

   To avoid potential denial of service attack, it is RECOMMENDED that
   implementations using the Peer Discovery mechanism maintain an
   information base of hosts that persistently fail Session
   Initialization having provided an acceptable Discovery signal, and
   ignore Peer Discovery signals from such hosts.

   This specification does not address security of the data plane, as it
   (the data plane) is not affected, and standard security procedures
   can be employed.

Thoughts? Suggestions?

Regards,
Stan

---

From: Henning Rogge <[email-masked]>
Date: Tue, 19 Jan 2016 10:13:48 +0100

On Tue, Jan 19, 2016 at 1:51 AM, Stan Ratliff <[email-masked]> wrote:
> Hello WG,
>
> As requested in the email thread earlier today, here's a snapshot of what we
> currently have in the upcoming DLEP-18 draft wrt security. We've put an

Maybe we could also mention that the same MAC layer security
mechanisms that can protect the DLEP control traffic would also
protect the radio-router DATA plane traffic.

Henning Rogge