Subject: [smartpower-interest] Looking for references/pointers to security research on wireless ad-hoc networks

From: "Akyol, Bora A" <[email-masked]>
Date: Mon, 25 Apr 2011 09:17:46 -0700

Hi everyone.

After doing the mandatory literature searches on IEEE, ACM and Google Scholar, I am looking to see if I have missed
any ongoing work at IETF regarding authorization and authentication of devices or software in wireless ad-hoc networks where
a centralized entity may not exist. Note that I am not looking for work on routing in MANET or encryption technologies.

This is related to ongoing smart grid work that I am doing.

Thank you very much for your help,

--
Bora Akyol, Pacific Northwest National Laboratory
+1 509 371 6682, [email-masked]<mailto:[email-masked]>, www.pnnl.gov

---

From: Greg Daley <[email-masked]>
Date: Wed, 27 Apr 2011 16:24:25 +1000

Hi Akyol, 

This sort of issue associated with authorization without a central authority is similar to other works
on peer-to-peer networking, without centralized authentication service.

The question is whether trust has been established previously (and we are recovering based on known 
relationships) or trust has never been present.

In the second case, it may be impossible to establish trust because of the low cost associated with
creation of fake identities on the wireless medium (Even with some sort of agreement protocol, it may
be possible to overwhelm the network using the unfortunately named Sybil attack).

In the first case, it may be possible to establish the identity of a peer by establishing common trust using
common trust relationships (back to a known source, perhaps using Certificates). 

Albeit this may be subject to attacks where the certified identity is compromised, and the existing connectivity
to a CRL or online Certificate validity server (using for example OCSP) is overwhelmed.

Another approach is to provide authentication via existing connected nodes back to the centralized site, but
using protections back to the central server.  I believe this may be covered by an independent submission
that is still being discussed on the (concluded) PANA Working group  mailing list.

http://www.ietf.org/mail-archive/web/pana/current/maillist.html

Sincerely,

Greg Daley
Consultant
Logicalis Australia Pty Ltd
  	 
E: [email-masked]
M: +61 401 772 770
P: +61 3 8532 4042
F: +61 3 8532 4032

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Akyol, Bora A
> Sent: Tuesday, 26 April 2011 2:18 AM
> To: [email-masked]
> Subject: [smartpower-interest] Looking for 
> references/pointers to security research on wireless ad-hoc networks
> 
> 
> Hi everyone.
> 
> After doing the mandatory literature searches on IEEE, ACM 
> and Google Scholar, I am looking to see if I have missed
> any ongoing work at IETF regarding authorization and 
> authentication of devices or software in wireless ad-hoc 
> networks where
> a centralized entity may not exist. Note that I am not 
> looking for work on routing in MANET or encryption technologies.
> 
> _______________________________________________
> smartpower-interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/smartpower-interest
>

---

From: Hector <[email-masked]>
Date: Fri, 29 Apr 2011 13:18:42 -0400

Depending on what packet mechanism he can settle with, a RFC5322-based 
payload using self-signed DKIM signatures with ADSP exclusive 
self-signed policy declarations will work by first addressing fault 
detection (policy violations) requirement.  What remains is valid 
authenticated payloads.

The trust is another matter as you pointed out.  Strict DKIM has been 
remodeled for a minimum layered single identity trustconcept, abeit 
3rd party certification.

That's been the long central contentious issue in DKIM working group - 
POLICY vs TRUST.  My position is that you need both. Filter the 
violations first and that includes policies to exclude 3rd party 
signers or authorize them.  Extensions for ADSP has been written to 
support authorized signers.

Without having a central entity is some what more difficult (i.e. DNS, 
public key location, etc) requiring some P2P networking knowledge. 
"Something" has to be shared.  I can imagine if this is private 
network of devices, the vendor will be the central trust identity.

   DomainKeys Identified Mail (DKIM) Signatures
   RFC4871 http://tools.ietf.org/html/rfc4871

   DKIM Author Domain Signing Practices (ADSP)
   RFC5617 http://datatracker.ietf.org/doc/rfc5617/

   DKIM Authorized Third-Party Signers  (ADSP extension I-D)
   http://datatracker.ietf.org/doc/draft-kucherawy-dkim-atps/

We are going to be using DKIM to assist in private mail networks 
first, external networking second with strong support for the 
deterministic nature of ADSP secured DKIM payloads.  This was outlined 
in my I-D:

   DKIM Signature Authorization Protocol (DSAP)
   http://tools.ietf.org/html/draft-santos-dkim-dsap-00

-- 
Hector Santos, CTO
http://www.santronics.com