Re: [homenet] Kathleen Moriarty's Discuss on draft-ietf-homenet-hncp-09: (with DISCUSS)

[Ted Lemon <[e-mail]>]

Wednesday, Nov 18, 2015 9:20 AM Steven Barth wrote:
> The basic idea behind the SHOULD is that there may be cases where either
> physical security of links (e.g. cables) can be ensured or link-layer
> security such as WPA for WiFi is present. In these cases (e.g. some sort
> homenet wifi repeater) the DTLS would be redundant.

WPA2, at least in PSK mode, does not provide confidentiality from attackers who have the PSK.   WPA isn't even as good as WPA2.   I think relying on this level of security makes sense if we have no alternative, but in no other case.

>   On links where this is not practical and lower layers do not provide
>   adequate protection from attackers, DNCP secure mode MUST be used to
>   secure traffic.
> 
> which should ensure that devices MUST use HNCP security over both
> physically and link-layer-wise unsecured links. I guess this could be
> reflected in the DNCP profile section as well if that makes it more clear.

So doesn't that make DTLS MTI already?   If so, maybe we should just say so explicitly.


--
Sent from Whiteout Mail - https://whiteout.io

My PGP key: https://keys.whiteout.io/[e-mail]