Participant Relationship Protocol

Back to matrix

F26-RI: Yes

Rationale

Contiki-NG v4.9 provides a native secured-PAN receive gate: tsch_security_check_level rejects unsecured frames while associated to a secured PAN and enforces the configured security level/key index. tsch_security_parse_frame verifies the MIC; the receive slot marks failures invalid before delivering data upward. This supplies the missing admission ordering for the selected 802.15.4 protection before onward 6LoWPAN forwarding.

Assessment method

Primary normative source and selected adjacency-policy analysis; no execution

Source context

Contiki-NG v4.9 security-level gate, MIC verification, slot delivery ordering and secured-only join policy

Outstanding qualification

Bounded mechanism witness: enable LLSEC802154, secured-only joining, secured PAN on all participating routers, and TSCH_SECURITY_CONF_SEC_LEVEL_OTHER=7 (ENC-MIC128). Provision private keys instead of demonstration keys; maintain nonce/ASN uniqueness across restarts. This selects the existing link-security mechanism, not a verified full RPL/DTLS integration. Scanning, radio airtime and authentication CPU are already spent; admitted key holders can still flood, and shared keys do not identify individual senders. The Linux v6.12 unsecured-frame bypass remains a separate unqualified implementation witness, not repaired by this result.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.