Subject: [6lowpan] #100: IESG comment #9 - Bootstrapping security threats

From: "6lowpan issue tracker" <[email-masked]>
Date: Mon, 26 Jul 2010 10:54:23 -0000

#100: IESG comment #9 -   Bootstrapping security threats
------------------------------------+---------------------------------------
 Reporter:  carlesgo@…              |       Owner:     
     Type:  enhancement             |      Status:  new
 Priority:  minor                   |   Milestone:     
Component:  routing-requirements    |     Version:     
 Severity:  -                       |    Keywords:     
------------------------------------+---------------------------------------
 Sec 5.4: In the security threats paragraph, it says:

   Bootstrapping may also impose additional threats.

 What are these threats?  How are they mitigated?

-- 
Ticket URL: <http://wiki.tools.ietf.org/wg/6lowpan/trac/ticket/100>
6lowpan <http://tools.ietf.org/6lowpan/>

---

From: "6lowpan issue tracker" <[email-masked]>
Date: Mon, 26 Jul 2010 10:56:41 -0000

#100: IESG comment #9 -   Bootstrapping security threats
------------------------------------+---------------------------------------
 Reporter:  carlesgo@…              |        Owner:        
     Type:  enhancement             |       Status:  closed
 Priority:  minor                   |    Milestone:        
Component:  routing-requirements    |      Version:        
 Severity:  -                       |   Resolution:  fixed 
 Keywords:                          |  
------------------------------------+---------------------------------------
Changes (by carlesgo@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 The document was updated to include the following:

 A malicious node can obtain initial configuration information in order to
 appear as a legitimate node and then carry out various types of attacks. A
 malicious node can also keep legitimate nodes busy by broadcasting
 authentication/join requests.

 One possibility for mitigating such threats is the use of mutual
 authentication schemes based on the use of pre-shared keys [1].

 [1]     M. Ikram et al., “A Simple Lightweight Authentic Bootstrapping
 Protocol for IPv6-based Low rate Wireless Personal Area Networks
 (6LoWPANs)”, IWCMC’09, Leipzig, Germany, June 2009.

-- 
Ticket URL: <http://wiki.tools.ietf.org/wg/6lowpan/trac/ticket/100#comment:1>
6lowpan <http://tools.ietf.org/6lowpan/>