Re: [homenet] Ted's security talk at IETF99: DNCP Security

[Ted Lemon <[e-mail]>]

On Jul 31, 2017, at 8:20 PM, Michael Richardson <[e-mail]> wrote:
>  a) do they really want this kind of traffic?
>  b) the certs issued will go into their cert transparency list, and I think
>     that means we lose privacy.
>  c) to make it work, they have to verify things.  IPv6 makes the
>     connectivity easy to arrange, but it seems like it's a big exposure for
>     the device.  We are talking more than just routers... I'm thinking
>     printers and all sorts of things.

Probably they don't, although they appear to be handling rather a lot of traffic already.   The problem is, we have no way to establish trust on a domain name because the browser vendors don't support DNSSEC-based TLS certs.   For some reason.   Not that I am bitter...

> It doesn't establish initial trust, it gives the user a trusted icon in their
> browser once we have initial trust.

Blrk.   I just don't think it's a good idea to burn certs into routers.   And I don't want the end user to be relying on their router vendor for their PKI.   But I will admit that I haven't done a thorough threat analysis, so I can't justify my collywobbles.

>    The Pledge can choose to accept vouchers using less secure methods.
>    These methods enable offline and emergency (touch based) deployment
>    use cases:

That ain't going to work.   But we can probably figure something out.

> Christian's comments in DNSSD (which I also watched today) is right though:
> for many applications in *discovery* is important you probably don't want
> certs, because they reveal too much, and the relationship is too ephermeral.
> The link between Dave's Laptop and Dave's Cool Printer is probably longer.

Indeed, but we don't want Dave's Laptop going around asking for Dave's Cool Printer when Dave's Laptop is not on the home network where Dave's Cool Printer lives.