Quick and Dirty Security for GRASP
The University of Auckland
School of Computer Science
University of Auckland
PB 92019
Auckland
1142
New Zealand
brian.e.carpenter@gmail.com
A secure substrate is required
by the Generic Autonomic Signaling Protocol (GRASP) used
by Autonomic Service Agents. This document describes QUADS, a QUick And
Dirty Security method using symmetric
cryptography and preconfigured keys or passwords.
As defined in , the
Autonomic Service Agent (ASA)
is the atomic entity of an autonomic function, and it is instantiated
on autonomic nodes. When ASAs communicate with each other, they should
use the Generic Autonomic Signaling Protocol (GRASP) .
It is essential that such communication is strongly secured to avoid
malicious interference with the Autonomic Network Infrastructure (ANI).
For this reason, GRASP must run over a secure substrate that is isolated
from regular data plane traffic. This substrate is known as the Autonomic Control
Plane (ACP). A method for constructing an ACP at the network layer is
described in .
Scenarios for link layer ACPs are discussed in .
The present document describes a simple method of emulating
an ACP immediately above the transport layer, known as QUADS (QUick And Dirty Security)
for GRASP.
Every GRASP message, whether unicast or multicast, is encrypted immediately before
transmission, and decrypted immediately after reception, using the same symmetric encryption
algorithm and domain-wide shared keys. This applies to all unicast and multicast messages
sent over either UDP or TCP. Typically encryption will take place immediately after a
message is encoded as CBOR , and decryption will take place
immediately before a message is decoded from CBOR.
There is no attempt to specify an automatic algorithm choice or key distribution
mechanism. Every instance of GRASP in a given Autonomic Network (AN) must be pre-configured
with the choice of encryption algorithm and any necessary parameters, and with the same key(s).
An alternative to configuring the keys is that every instance of GRASP
is pre-configured with a fixed salt value and the keys are created from a locally chosen
domain password, using a pre-defined hash algorithm and that salt value. Note that the
salt value cannot be secret as it must be the same in all QUADS for all
GRASP implementations. In this model the secrecy depends on the password.
The choice of algorithms should follow best current practice, e.g. .
QUADS for GRASP has been implemented as a small extension to the Python GRASP prototype,
using the Python 'cryptography' module. The algorithm choices were:
Encryption: AES/CBC, key lengths 32/16, padding PKCS7(128).
Password hash: PBKDF2HMAC SHA256, length 32, 100000 iterations.
Salt used for password hash: 0xf474526a2e74accee189f1fbc1c34ceb.
The code will be posted to https://github.com/becarpenter/graspy when stable.
QUADS provides effective secrecy for all GRASP messages, against any party not in possession of the
relevant shared keys. However, before a GRASP message is encrypted or after it is decrypted, it is
not protected within the host. Therefore, secrecy is only effective against nodes that do not contain
a GRASP instance in possession of the keys. Those nodes cannot send valid GRASP messages,
and they cannot interpret intercepted GRASP messages, including multicasts. However, they
might attempt traffic analysis.
QUADS provides authentication of GRASP instances to the extent that they must be in
possession of the relevant shared keys.
QUADS depends on manual configuration of keys, or on password entry, for each
autonomic node.
QUADS offers no defence against denial of service attacks.
This document makes no request of the IANA.
Excellent suggestions were made by
TBD
draft-carpenter-anima-quads-grasp-00, 2019-10-16:
Initial version