Use of Timed Efficient Stream Loss-Tolerant Authentication (TESLA) in the Asynchronous Layered Coding (ALC) and NACK-Oriented Reliable Multicast (NORM) Protocols

Abstract

This document details the Timed Efficient Stream Loss-Tolerant

Modified Timed Efficient Stream Loss-tolerant Authentication to Secure Power Line Communication

“…There are many cryptographic mitigation techniques available to secure PLC for smart meters. These include Distributed Network Protocol (DNP3) [23], [24], X.509 [25], RSA [26], and TESLA [27]. All these techniques have different capabilities and limitations.…”

Simple Authentication Schemes for the Asynchronous Layered Coding (ALC) and NACK-Oriented Reliable Multicast (NORM) Protocols

“…All the schemes mentioned in Section 1 (some of which are specified in this document) use the same HET=1 (EXT_AUTH) Authentication Header extension mechanism defined in [RFC5651]. Therefore, the same 4-bit ASID field has been reserved in all the specifications (see Sections 3.1, 4.1, 5.1, and 6.1, as well as Section 5.1 of [RFC5776]). For a given ALC or NORM session, the ASID value contained in an incoming packet enables a receiver to differentiate the actual use and format of the contents of the HET=1 (EXT_AUTH) header extension.…”

Asynchronous Layered Coding (ALC) Protocol Instantiation

“…[RMT-SIMPLE]and [RFC5776] described packet level authentication schemes that can be used with the ALC protocol.…”

“…Thus, it is also RECOMMENDED that packet-level authentication be used to protect against such attacks. Timed Efficient Stream Loss-Tolerant Authentication (TESLA) [RFC5776] can also be used to some extent to limit the damage caused by such attacks. However, with TESLA, a receiver can only determine if a packet is authentic several seconds after it is received, and thus an attack against the congestion control protocol can be effective for several seconds before the receiver can react to slow down the session reception rate.…”

“…Some packet authentication schemes such as TESLA [RFC5776] do not allow an immediate authenticity check. In this case, the receiver SHOULD check the authenticity of a packet as soon as possible, and if the packet fails the check, then it MUST be silently discarded before…”