Re: [Dtls-iot] FW: New Version Notification for draft-keoh-dice-multicast-security-08.txt

[Michael StJohns <[e-mail]>]

On 7/8/2014 11:08 AM, Carsten Bormann wrote:
> On 08 Jul 2014, at 16:50, Michael StJohns <[e-mail]> wrote:
>
>> 1) You can't do integrity protection without source authentication.
> That depends on your attack model.
>
> Given that much of today’s IoT “security" is depending on a single WiFi key for a whole installation, application-based group keying is still significant progress for those cases where the attack model doesn’t rule out group keying.
>
> Grüße, Carsten
>

Hi Carsten -

To get to a common point, what I mean by integrity at this point is:  "A 
message can't be modified between a sender and receiver without 
detection by the receiver" - do you agree with this definition?  Under 
that definition if I'm doing multicast symmetric key integrity 
protection, then a third party who holds that key can change the message 
without detection.  If the key is only held by one other party, then I 
know the source as well as the integrity of the message.  Likewise with 
public key - if I can verify the message with a public key, I know the 
holder of the private key is the originator.  All of these guarantees 
break down if a) a symmetric key is shared between more than 2 parties, 
or b) a private key is shared between more than a single party.

In the WiFi model, mostly the "mesh" is one deep.  There's the access 
point and then there's everyone else.  The size of the mesh is 
relatively small (~20 - 200 if you're talking about an IETF meeting!), 
and almost every device talks directly to the AP. Mostly the comm model 
for WiFi is that the wireless guys want something on the wired internet 
- they rarely need to talk to the other wireless devices.  Some "IoT" 
approaches have reused WiFi security - and not in a good way considering 
the WiFi security protocol (802.1x) is such that it doesn't scale very 
well with depth of mesh or number of nodes.  It also doesn't do a lot of 
packet level multicast for the normal designed-to case (e.g. internet 
access).

> application-based group keying is still significant progress for those cases where the attack model doesn’t rule out group keying.

The use cases where this works all seem to involve a secure processing 
element and that's not exactly within the DICE charter. The most 
successful group keying system I'm aware of is pay TV (either satellite 
or cable).  Those systems - obviously - use a secure processing element 
(e.g. smart card or built in) to manage group keys and decryption based 
on credentials.

I literally can't think of a use case without an SPE where the attack 
model doesn't rule out group keying for integrity protection and most 
attack models for most use cases rule it out for confidentiality.


Mike