Re: [Add] Authentication Sub-topics for Tuesday Interim (homework for Tuesday's meeting)

On Mon, 14 Sep 2020 at 04:51, Eric Rescorla <ekr@rtfm.com> wrote:

> (1) What capabilities are we going to assume an attacker has in the local
> discovery model?
>

We can start with RFC 3552 and evaluate if a weaker threat model is
required.

> Do we have *any* candidate design which does anything useful in those
> circumstances? If so, what does that design do?
> (2) Do we have any secure way to tell clients which resolver the network
> wants them to use?
>

Yes, secure discovery is possible in certain deployments (e.g., Enterprise,
VPN) but not in networks with common passwords for WiFi
authentication/Opportunistic Wireless Encryption (susceptible to passive
and active attacks).

> (3) Assuming that we had a secure way to tell clients which resolver the
> network wanted them to use, what would we want to say there?
>

> Spoiler alert: I have opinions on the answers to these questions, but that
> seems like a topic for the interim.
>
> -Ekr
>
>
>
> On Fri, Sep 11, 2020 at 11:51 AM Deen, Glenn <Glenn_Deen@comcast.com>
> wrote:
>
>> Hi ADD,
>>
>>
>>
>> Authentication clearly has emerged as a topic important to the group.
>> It showed up during the ADD Interim on Sept 10th in both comments and in
>> jabber. Prior to that It has shown up in  drafts, list traffic and GitHub
>> issues.      Coming out of the Interim yesterday it was proposed as the
>> starting topic for the next interim on Tuesday Sept 15.
>>
>>
>>
>> To help focus and facilitate productive conversation the chairs would
>> like to ask for the group’s help in breaking down the topic of
>> authentication into sub-topics for Tuesday’s interim session.
>>
>>
>>
>> Here’s a small homework assignment for the next couple of days to help
>> set the Interim agenda:  We ask that ADD participants please take a few
>> minutes and post to this list thread authentication sub-topics you’d like
>> to cover.
>>
>>
>>
>> To get you thinking on the question,  consider that authentication has
>> come up in a variety of ADD discussions:
>>
>>
>>
>>       (1) Topic:  the question of can DHCP play a role in discovery which
>> has resulted in many saying “No” since it isn’t authenticated;
>>
>>       (2) Topic:  the question of authentication’s role in resolver
>> discovery and validation;
>>
>>       (3) Topic:  the question of authentication to enable identification
>> of resolvers that are associated or affiliated with one another or an
>> organization
>>
>>       ….
>>
>>
>>
>>
>>
>> This list is by no means complete and is meant to illustrate a few of the
>> places and contexts the topic of “Authentication” has popped up recently.
>>
>>
>>
>> Please share what authentication topic, scenario, role, need you believe
>> the ADD group should spend time discussing on the Tuesday agenda.
>>
>>
>>
>> Please limit discussion on this particular thread to only sharing what
>> authentication sub-topic aspect you’d like to see discussed and not expand
>> into a discussion of the sub-topics themselves.   Yes this all interesting
>> stuff, but the thread can quickly become overwhelming for readers to
>> follow.
>>
>>
>>
>> So limit, for now, responses to what you’d like to discuss – not the
>> actual technical discussion.
>>
>>
>>
>> Also, this may prompt some responders to feel like now it is a good time
>> to stray into policy discussions.   Please try to self-regulate and not go
>> there.    ADD is limited to technical mechanisms to do discovery and a
>> means to convey information about the discovered resolvers – and the
>> discussion needs to stay withing those boundaries.
>>
>>
>>
>> Regards
>>
>> Glenn Deen & David Lawrence – ADD Chairs
>> --
>> Add mailing list
>> Add@ietf.org
>> https://www.ietf.org/mailman/listinfo/add
>>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>