Re: [DNA] Ordering Hash-based RAs

[Greg Daley <greg.daley@eng.monash.edu.au>]

Hi Brett.

Brett Pentland wrote:
> Greg Daley wrote:
> 
>> Dear DT,
>>
>> I really like the hash based RA scheme indicated in the
>> document draft-pentland-dna-protocol-00.
> 
> 
> :)  That's good to hear.
> 
>> I think there's an issue with its robustness to false
>> or hijacking routers, which may limit its usefulness though.
> 
> 
> Aside:  There will be many things that rogue devices can do to
> disrupt things if SEND is not used.  If SEND is used then I don't
> think the following scenario is a problem, however...


The trick with SEND is to allow explicit trust of the other routers
using common trust anchors, and then most importantly, closing
FastRA to non-trusted SEND or non-SEND routers.

This is not really what the hash based RA mechanism was aimed at,
without diminishing the usability significantly.

There's a SEND configuration flag already (defaulting to off)
which allows unsecured messages to be ignored.
I don't think we'd need to define anything for DNA.

Unless that flag is used, the hash-based RA scheme is subject to
the attacks you alluded to (but may be fairly robust to them).

[cut]
>> The essential issue here is that the solicitors' addresses aren't
>> well distributed.
> 
> 
> Agreed.
> 
>> Two alternatives which overcome this issue are:
>>
>> 1) Perform the XOR comparison with the low order bytes of the IID
>>    first (either reverse the XORed bit strings, or do bytewise
>>    comparisons starting at the 16th byte).
>>
>> 2) Ensure that the solicitors' input values are well distributed,
>>    perhaps using a hash.
>>
>> I'd lean towards 1).  It's probably fastest computationally, and
>>   was easy to implement in 16th-to 1st byte comparison form.
> 
> 
> I'd also lean towards 1) since it doesn't require calculating a hash
> for each RS received.  Doing the bytewise comparison starting at the
> low order byte (the 8th since there's only 64 bits in the IID) sounds
> like the better option to me, and sounds worth doing.

Oops
Sorry about that.

Greg