\section{Computational Measurements}

We measured the speed of the keyed-md5 checksum over various size
packets with two computers,
a 75 megahertz Pentium laptop (that one may assume is a candidate
mobile node) and a 166 megahertz desktop (agent).   We wanted
to determine how much computation is needed for authentication of beacons 
and to reflect on computation versus bandwidth issues.

The table below shows the computer speed,
the number of bytes authenticated in a packet,
the number of authenticated packets per second that could be sent,
and the maximum algorithm throughput in kbytes/sec
that can be supported for that size of packets.
Note that the MD5 key is 16 bytes long.  
As a yardstick, real bandwidth for WaveLAN is on the order of 
1 megabit/second.   For example, with ftp (ncftp) transfers we can get 
about 117 kbytes/second on an unloaded radio link.  

$$
\arraycolsep=4pt
\begin{array}{|c|c|c|c|} \hline
computer & size & pkts/sec & kbytes/sec \\  \hline
%
75mhz & 60 & 33000 & 1980 \\  \hline
75mhz & 512 & 9680 & 4956 \\  \hline
75mhz & 1024 & 3683 & 3771 \\  \hline
166mhz & 60 & 74074 & 4444 \\  \hline
166mhz & 512 & 21549 & 11033 \\  \hline
166mhz & 1024 & 8203 & 8399 \\  \hline
\end{array}
$$

From examination of the maximum throughput figure in column 4,
one can see that even
the smallest packet size on the slower computer well exceeds the
radio link speed.  Our 60 byte sample is roughly the size of the 
authenticated part of our beacons.  In fact, the computer's speed
is more than enough to deal with the authentication task
for current 10 megabit ethernet links, and on faster computers 
may begin to be able to deal with a 100 megabit ethernet link.
Of course authentication algorithms that have more rounds or longer-keys
will be slower.  Still using authentication in routing is not something
that should be questioned on the basis of efficiency.  Mobile-IP Agents
might be getting many beacons from nearby mobile nodes but they
should be able to handle the computational load.  

One may also observe that over WaveLAN, it would be fairly senseless
to initiate a denial of service attack based on feeding authenticated
packets with the wrong key to a node.  A node can
checksum the packets much faster than they can be written out to the
link.  One might just as well spray the radio link with packets in order
to use up all available bandwidth.  
