Re: [homenet] Stephen Farrell's Discuss on draft-ietf-homenet-hncp-09: (with DISCUSS and COMMENT)

Markus Stenberg <markus.stenberg@iki.fi> Fri, 20 November 2015 15:35 UTC

Return-Path: <markus.stenberg@iki.fi>
X-Original-To: homenet@ietfa.amsl.com
Delivered-To: homenet@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A42E1B2A4F; Fri, 20 Nov 2015 07:35:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.821
X-Spam-Level:
X-Spam-Status: No, score=-1.821 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mErQOzqqSYFJ; Fri, 20 Nov 2015 07:35:32 -0800 (PST)
Received: from julia1.inet.fi (mta-out1.inet.fi [62.71.2.193]) by ietfa.amsl.com (Postfix) with ESMTP id 318D11B2A53; Fri, 20 Nov 2015 07:35:30 -0800 (PST)
Received: from poro.lan (80.220.86.47) by julia1.inet.fi (9.0.002.03-2-gbe5d057) (authenticated as stenma-47) id 5613C7B1013C0C60; Fri, 20 Nov 2015 17:33:48 +0200
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\))
From: Markus Stenberg <markus.stenberg@iki.fi>
In-Reply-To: <564F38AC.9090703@cs.tcd.ie>
Date: Fri, 20 Nov 2015 17:35:27 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <76EE20C7-F1C6-46B2-B8DD-373B0760165B@iki.fi>
References: <20151119142137.30137.298.idtracker@ietfa.amsl.com> <06BE7ED5-0D2F-4B0F-A8AB-B8E5CA562376@iki.fi> <564F38AC.9090703@cs.tcd.ie>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
X-Mailer: Apple Mail (2.3096.5)
Archived-At: <http://mailarchive.ietf.org/arch/msg/homenet/7KE3r7nI7HC9yaJpaVs0lvmK86c>
Cc: homenet-chairs@ietf.org, homenet@ietf.org, Mark Townsley <mark@townsley.net>, The IESG <iesg@ietf.org>, draft-ietf-homenet-hncp@ietf.org
Subject: Re: [homenet] Stephen Farrell's Discuss on draft-ietf-homenet-hncp-09: (with DISCUSS and COMMENT)
X-BeenThere: homenet@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF Homenet WG mailing list <homenet.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/homenet>, <mailto:homenet-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/homenet/>
List-Post: <mailto:homenet@ietf.org>
List-Help: <mailto:homenet-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/homenet>, <mailto:homenet-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Nov 2015 15:35:35 -0000

<snipping resolved parts/earlier comments>

On 20.11.2015, at 17.13, Stephen Farrell <stephen.farrell@cs.tcd.ie>; wrote:
> Hmm. I've also setup many small PKIs and don't agree. I do
> think someone could easily make all that quite usable within
> the home. I agree that that hasn't happened to date though.
> (Maybe being a co-author of rfc5280 I probably find all that
> PKI nonsense easier to deal with than most developers;-)

Chuckle, I was exaggerating slightly too, but e.g. for my retired mother to deal with (even one set up by me) CA seems rather .. challenging. And that’s the level of configuration skill this solution should work with, if it is to be useful.

> Summary: I think when using DTLS for this, support for PSK ought
> be a MUST, PKI could be MUST or SHOULD and the consensus thing
> probably has to remain as a MAY, since we've not got evidence
> that it’d work well enough (yet).

Very well. I swapped the SHOULD/MAY([1]), as I do not consider having two MUSTs really good, and as PKI stuff really is relatively large, I prefer having the minimal guaranteed interoperable implementation be small.

>> It essentially broadens a number of on-link attacks to network-wide
>> ones. Notably you can redirect arbitrary traffic wherever you want
>> (without HNCP, you do RA/DHCPv4 faster than router on the link ->
>> MITM), and DoS of the network instead of on-link nodes.
> 
> The above may be worthwhile to add to the security considerations.
> No harm to remind folks of such things.

All except traffic redirection were already in 12.2. subsection actually. Added traffic redirection there in [1] (it is not intrisic property of HNCP, but given HNCP carries routing protocol keys and/or it is unsecured, ..)

Cheers,

-Markus

[1] https://github.com/fingon/ietf-drafts/commit/f8275e165802a9c310f0bbde98e42087ecc891b1