On Mon, 2008-12-22 at 19:30 +0100, Henning Rogge wrote:
> On Montag 22 Dezember 2008 17:59:00 Bernd Petrovitsch wrote:
> > > Yes... because IPSec mostly deals with unicast traffic. Multicast
> > > (broadcast is a special case) is MUCH MORE difficult.
> >
> > Yes, because you have to have different (symmetric) keys for each
> > multicast group and change the key if one joins or leaves the group. And
> > there are probably more similar problems.
> > Let alone to *guarantee* that no one uses the old one ....
> You are missing my point.

Maybe.

> A group key does not allow for athentification within the group, so it's 
> useless for securing OLSR routing packages against attackers inside the 
> network (because they will have the group key).

Well, for signing large data chunks, the usual hack is to calculate a
(relatively) cheap checksum (e.g. MD5[0], SHA-1, ..) and sign that.
And if the packets are not that large (so that an additional checksum
field seems too expensive), signing the packet as such should be fast
enough too.
Of course the performance will drop compared to an "unsecure" net like
today - but everything comes at a price IMHO.

	Bernd

[0]: Yes, MD5 is quite weak nowadays.
-- 
Firmix Software GmbH                   http://www.firmix.at/
mobil: +43 664 4416156                 fax: +43 1 7890849-55
          Embedded Linux Development and Services




