<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 5, 2018, at 7:20 PM, mengxue <<a href="mailto:mengxue_1224@126.com" class="">mengxue_1224@126.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="line-height: 1.7; font-size: 14px; font-family: Arial;" class=""><div class="">Hi, all </div><div class=""><br class=""></div><div class=""> Thank you for your reading!</div><div class=""> I have some doubts about the security issues of the Interest. What I have learned is that an Interest packet is not secured by design(such as no signature).So I wonder if an attacker can modify the elements of the original Interest, such as changing one name component ,or changing the Selector part or changing the Nonce part or changing the additional part added to the Interest by the developers.</div><div class=""> Thank you very much!</div></div></div></blockquote><br class=""></div><div>first, some nits: </div><div>- there is no more selector (see the current protocol spec)</div><div>- data fetching interests for publicly accessible data are not signed; they have no logical side effect on producers in general (and not signing has the benefit of obscuring requesters).</div><div>- an interest can and should be signed, if it leads to an effect (e.g. a command interest).</div><div><br class=""></div><div>second: the above mentioned interests modifications assume that an attacker is MIM (man-in-middle, i.e. on interest forwarding path): in this case the attacker can already do denial of service by dropping the interests; modifying interests is likely leading to the same result</div><br class=""></body></html>