IETF Logo Mail Archive

Re: Security for the IETF wireless network

Bill Fenner <fenner@fenron.com> Fri, 25 July 2014 14:30 UTC

Return-Path: <fenner@fenron.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC8691A02CF for <ietf@ietfa.amsl.com>; Fri, 25 Jul 2014 07:30:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.977
X-Spam-Level:
X-Spam-Status: No, score=-101.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PGt1XXkDy4Ec for <ietf@ietfa.amsl.com>; Fri, 25 Jul 2014 07:30:26 -0700 (PDT)
Received: from mail-qg0-f49.google.com (mail-qg0-f49.google.com [209.85.192.49]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 770171B2828 for <ietf@ietf.org>; Fri, 25 Jul 2014 07:30:18 -0700 (PDT)
Received: by mail-qg0-f49.google.com with SMTP id j107so5086809qga.8 for <ietf@ietf.org>; Fri, 25 Jul 2014 07:30:17 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=PifparfdA6vRNkjAD8HF0gz996n9voxumTZVFZssw6M=; b=P3mf/joZzNtA1TJ/R7eG5eAHxS5/5W0ggppg9+jcFEoK0l5Ro0O5vi7DbKawoFBckR uv7MnCSyPFsnyomY2nfXEknNJVe6LjPE0E3ScRQUralQihq5joMt7Ulmcfq7TzHZzMte TrSOk6W+aLZ12IK2cTQZnYIpOEhcAYG/8kdOV4o4tjtpqFn2dBnY0cEXBnWxtHGdgUQ2 YndISQCOcv+VfDXNuklgKRX7x6CzRl99HZPA7PertQhuE8xX/MYNIrHyRjXSmUH96OYy pwbv2ZKragwf54JdIzbzbOn65YSC05c5ARdrEMtBJDT2nTrdfenWXkXVNV1PSI2rJwuw 0qKw==
X-Gm-Message-State: ALoCoQmoPUCfHMB293Ybw8zTMyjzQT6RChDac4w81UmNaj357ovSLN9iyyci/w0eqXWCZzGZPnaj
MIME-Version: 1.0
X-Received: by 10.224.120.138 with SMTP id d10mr28209995qar.9.1406298617521; Fri, 25 Jul 2014 07:30:17 -0700 (PDT)
Received: by 10.224.204.72 with HTTP; Fri, 25 Jul 2014 07:30:17 -0700 (PDT)
In-Reply-To: <53D267FF.3060102@restena.lu>
References: <0FE63216-9BE8-450F-80FB-D1DB6166DFEF@ietf.org> <53D17359.2030505@gmail.com> <CFF7BAFE.28A14%wesley.george@twcable.com> <53D25789.8000804@restena.lu> <CAATsVbY44t7QvDNe4UcBfM1MpzkphZYCyHPz=Mwax95fSpjmFg@mail.gmail.com> <53D267FF.3060102@restena.lu>
Date: Fri, 25 Jul 2014 10:30:17 -0400
Message-ID: <CAATsVbbmYaF0rq2a7wpHn8YguaMP1pNr=pcieU7h1iJO5fJxag@mail.gmail.com>
Subject: Re: Security for the IETF wireless network
From: Bill Fenner <fenner@fenron.com>
To: Stefan Winter <stefan.winter@restena.lu>
Content-Type: multipart/alternative; boundary="001a11c2eea08bc0d804ff056993"
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/3wWzdicpaMb3ALC0y1q1wZ2Zr7o
Cc: IETF Discussion <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jul 2014 14:30:33 -0000

On Fri, Jul 25, 2014 at 10:21 AM, Stefan Winter <stefan.winter@restena.lu>
wrote:

> > The desired incremental delta between the "ietf" open SSID and the
> > "ietf.1x" encrypted SSID is the addition of encryption.  The additional
> > validation of "is this really the IETF" has been a non-goal.
> >
> > It's appropriate for organizations with different goals to have
> > different policies.
>
> Sure. Adding the authentication is not difficult though if you already
> went through the pain of a RADIUS server setup. Basically, a few lines
> of HTML description of the network give you all the extra goodness.
>

Meaning, you'd be happy if we replace "Do not validate server cert" with
"If you'd like to validate the server cert, you can import the public key
<a href="...">here</a>, or the fingerprint is 53 63 6f 6f 62 79 20 44 6f 6f
62 79 20 44 6f 6f 21"?

  Bill

v2.23.0 | Report a Bug | By Email