IETF Logo Mail Archive

Re: [homenet] Kathleen Moriarty's Discuss on draft-ietf-homenet-hncp-09: (with DISCUSS)

Ted Lemon <mellon@fugue.com> Fri, 20 November 2015 18:22 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: homenet@ietfa.amsl.com
Delivered-To: homenet@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD5A51B3C27; Fri, 20 Nov 2015 10:22:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.487
X-Spam-Level:
X-Spam-Status: No, score=-2.487 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3fmc-CLzRShF; Fri, 20 Nov 2015 10:22:48 -0800 (PST)
Received: from fugue.com (mail-2.fugue.com [IPv6:2a01:7e01::f03c:91ff:fee4:ad68]) by ietfa.amsl.com (Postfix) with ESMTP id 41BBC1B3C25; Fri, 20 Nov 2015 10:22:47 -0800 (PST)
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="----sinikael-?=_1-14480437639730.01551808463409543"
From: Ted Lemon <mellon@fugue.com>
To: homenet@ietf.org
In-Reply-To: <CAGnRvup0qqmHy0Bwe1hCWGDKPYmG602kC1HJ_T-89Ef=uPMdQw@mail.gmail.com>
References: <20151117235034.24927.22561.idtracker@ietfa.amsl.com> <564C8923.5060705@openwrt.org> <1447861588613-80e36dd7-a4018a10-e1e3de86@fugue.com> <CAGnRvup0qqmHy0Bwe1hCWGDKPYmG602kC1HJ_T-89Ef=uPMdQw@mail.gmail.com>
Date: Fri, 20 Nov 2015 18:22:43 +0000
Message-Id: <1448043764301-a4cf71a1-a6f14feb-cee5377c@fugue.com>
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/homenet/vxxzhEUhoW8grhZQtxsloMD6sGY>
Cc: iesg@ietf.org
Subject: Re: [homenet] Kathleen Moriarty's Discuss on draft-ietf-homenet-hncp-09: (with DISCUSS)
X-BeenThere: homenet@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF Homenet WG mailing list <homenet.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/homenet>, <mailto:homenet-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/homenet/>
List-Post: <mailto:homenet@ietf.org>
List-Help: <mailto:homenet-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/homenet>, <mailto:homenet-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Nov 2015 18:22:49 -0000

Wednesday, Nov 18, 2015 11:04 AM Henning Rogge wrote:
> On Wed, Nov 18, 2015 at 4:46 PM, Ted Lemon <mellon@fugue.com> wrote:
>> WPA2, at least in PSK mode, does not provide confidentiality from attackers who have the PSK.   WPA isn't even as good as WPA2.   I think relying on this level of security makes sense if we have no alternative, but in no other case.
> 
> I don't think DTLS with PSK is much better than WPA2 with PSK...

I bought this argument when I first saw it, but when reading Stephen's comment just now (arguing that PSK should be MTI) I realized that I was wrong.  The PSK in the case of HNCP is being shared amongst infrastructure devices, _not_ amongst end users, unlike the WPA2 PSK, which everybody using the network must know.

So while it is certainly _possible_ for the PSK to be vulnerable in the way you describe, it is not _necessary_ for it to be vulnerable in that way, and therefore even the DTLS/PSK mode of secure HNCP is preferable to no security at all.


--
Sent from Whiteout Mail - https://whiteout.io

My PGP key: https://keys.whiteout.io/mellon@fugue.com

v2.23.0 | Report a Bug | By Email