Subject: [Roll] RPL over "secured" lower-layers

From: Michael Richardson <[email-masked]>
Date: Mon, 26 Jul 2010 06:36:20 -0400

There is has been much discussion in the 'Signature Consultation' over
what it means to use vs rely on a lower layer security protocol.  I
ignore that discussion to ask a technical question.

The RPL specification provides for three modes of operation (section
9.1):

   o  Insecure.  In this security mode, RPL uses insecure DIS, DIO, DAO,
      and DAO-Ack messages.

   o  Pre-installed.  In this security mode, RPL uses secure
      messages....

   o  Authenticated.  In this security mode, RPL uses secure messages.
      ... To join the network as a router, a node must obtain a second
      key from a key authority.  

I'd just like to know how does one use and implement these multiple keys
when running on top of a "secure" link-layer?

Is there an implicit requirement for the secure radio layer to indicate
to upper layers which key is being used?   Do all radios support use of
multiple simultaneous keys, and permit the upper layers to specify which
key to use to send a particular message? 
Seems like there is a series of drafts (RPL-over-FOO) missing here.

- -- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Michael John <[email-masked]>
Date: Mon, 26 Jul 2010 21:25:51 +0200

Michael

> when running on top of a "secure" link-layer?

I would expect the pre-installed keys to be provisioned out of band or to be
factory installed. A in-band provisioning seems feasible for the secured
lower layer case. In this scenario an Application Layer protocol could to be
used to provision the keys.

> key to use to send a particular message?

I do not see the requirement for the keying material used by the lower layer
to be shared with the rpl instance (not sure if I got your question right).
I would expect rpl security modes to operate independently from lower layer
security.

> Seems like there is a series of drafts (RPL-over-FOO) missing here.

I agree that a general guideline how to operate rpl would be useful. For
example, to provide use case for each security mode. In certain scenarios
with a fully secured lower layer "insecure" operation mode of rpl might be
sufficient.

Cheers,
Michael

---

From: Michael Richardson <[email-masked]>
Date: Mon, 26 Jul 2010 17:15:41 -0400

>>>>> "Michael" == Michael John <[email-masked]> writes:

    mcr> I'd just like to know how does one use and implement these
    mcr> multiple keys when running on top of a "secure" link-layer?

    Michael> I would expect the pre-installed keys to be provisioned out
    Michael> of band or to be factory installed. A in-band provisioning
    Michael> seems feasible for the secured lower layer case. In this
    Michael> scenario an Application Layer protocol could to be 
    Michael> used to provision the keys.

I don't think you understood the question. 
I didn't ask how the keys were provisioned --- that's the question you
answered.

I asked, once they are provisioned, how does the layer-3 RPL layer tell
what key was used to secure a packet?   This matters.

In RPL, we have three levels of security.

In level 0, there is no security.
In level one, a node can join as a leaf.
In level two, a node cna join as a router.

If the security is provide by a secure link-layer (i.e. buried in an
attached secure radio chip), how can one tell if a node is a level 1 or
level 2 node?   Do those devices even tell you?

--