Re: [87attendees] IETF wireless

Stefan,

The cert we are using for the IETF SSIDs authenticated via 802.1X (not
including eduroam) is from the same CA that is providing the certs for the
rest of the IETF (including web, email, dnssec, and more, I believe). This
CA (Starfield Secure Certification Authority) is in most or all recent OSes
and browsers root certificate store. Which means most 802.1X supplicants
/can/ verify the server cert we supply. It's up to the user to not un-check
the "Check server cert" box! Our thought was that that was sufficient.

However, we certainly can look into doing as you suggest and publishing
more information. Of course, the page we post this to will probably also be
verified by this same CA... ;-)

Chris.

On Thu, Aug 8, 2013 at 2:35 AM, Stefan Winter <stefan.winter@restena.lu>wrote:

> Hi,
>
> > Scary how many are using the unencrypted wifi.
>
> Don't only count the ietf.1x network. The IETF also provides eduroam,
> which is WPA2/AES with 802.1X and - sorry, NOC: actual server
> certificate verification, not a "don't verify ours, and we won't verify
> yours".
>
> The Max numbers in the NOC report are
>
> the 3 "secure" ones: 25+27+37 = 89
> the two "edu" ones: 38 53 = 91
>
> Which makes for a total of 180 max simultaneous encrypted connections.
>
> Sure, compared to approx. 700 on the open networks it's not so really
> great, but still quite a significant portion.
>
> > A suggestion for next IETF would be to call the 802.1x wifi "IETF" and
> > the open one "IETF_UNENCRYPTED".
>
> Without verifying the server cert of the 802.1x network, you may well
> talk to the network encryptedly, but the network might be a MitM who can
> decrypt and snoop out your traffic.
>
> The ietf.1x network is just not as good as it could be - maybe more
> people would be inclined to use it if it provides the extra benefit of
> being able to identify itself as *the genuine* IETF network. Neither the
> open network nor the ietf.1x currently do that.
>
> The fix would be surprisingly simple: in the Network Information page,
> actually *publish* the CA cert and its fingerprint that signs the auth
> server, and also publish the server's subject/subjectAltNames. This
> allows every user to check whether he's on the real thing when connecting.
>
> There are also provisioning tools that can install the CA certs and EAP
> settings onto client devices. It's not rocket science.
>
> Greetings,
>
> Stefan Winter
>
>
>
>
> --
> Stefan WINTER
> Ingenieur de Recherche
> Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
> de la Recherche
> 6, rue Richard Coudenhove-Kalergi
> L-1359 Luxembourg
>
> Tel: +352 424409 1
> Fax: +352 422473
>
>
> _______________________________________________
> 87attendees mailing list
> 87attendees@ietf.org
> https://www.ietf.org/mailman/listinfo/87attendees
>

-- 
Chris Elliott
chelliot@pobox.com