Re: [ipwave] draft-ietf-ipwave-ipv6-over-80211ocb-00 Security of WSMP and WSA is FYI only

I wasn't that tired :-)

1609.3 section 6.2.4.2.1 specifies how a WSA can be protected with
1609.2 mechanisms. 1609.3 Annex H gives the 1609.2 security profile
for WSA. So I think it's accurate to say that 1609.3 specifies
security mechanisms, which are defined in 1609.2, to protect WSA.
1609.2 only mentions WSA twice, once in an example, once in an
informative annex. So I think "1609.3 specifies security mechanisms
(from 1609.2)" is an accurate way to say this, just as if WSAs were
sent over TLS, "1609.3 specifies security mechanisms (from TLS)" would
be accurate.

The reason why this matters is that it emphasizes that when you're
going over WSMP, it's up to the specification of the higher layer
entity (in this case, the WME) to specify the security; WSMP itself
doesn't provide any security, and 1609.2 is just a set of tools that
have to be explicitly referenced in the higher layer entity
specification.

Cheers,

William

On Fri, Feb 10, 2017 at 9:20 PM, Dick Roy <dickroy@alum.mit.edu> wrote:
> William is a bit tired ... it was a long flight!  The security mechanisms
> are found in 1609.2, not 1609.3 :^))) Other than that, he is absolutely
> right as usual, if for no other reason than he was and still is the most
> significant contributor to this effort.
>
> Cheers,
>
> RR
>
> -----Original Message-----
> From: William Whyte [mailto:wwhyte@securityinnovation.com]
> Sent: Friday, February 10, 2017 8:32 AM
> To: Alexandre Petrescu
> Cc: its@ietf.org
> Subject: Re: [ipwave] draft-ietf-ipwave-ipv6-over-80211ocb-00 Security of
> WSMP and WSA is FYI only
>
> To be clear, WSMP has no inbuilt security. Higher layer entities that
> use WSMP may send secured payloads but this is part of the application
> specification, not provided by WSMP.
>
> WSA is an example of such a higher layer entity; 1609.3 specifies
> security mechanisms (from 1609.2) that are applied before sending the
> WSA over WSMP. Note that whether or not to use the 1609.3 security
> approach is up to individual deployments -- a private deployment, for
> example, could conceivably decide to use different security or no
> security, but the recommended approach is the one in 1609.3.
>
> Cheers,
>
> William
>
> On Fri, Feb 10, 2017 at 2:52 AM, Alexandre Petrescu
> <alexandre.petrescu@gmail.com> wrote:
>> draft-ietf-ipwave-ipv6-over-80211ocb-00
>> Security of WSMP and WSA is FYI only
>>
>> Hello IPWAVErs,
>>
>> We received a comment suggesting that our mentioning of IEEE WSMP and
>> WSA being secure should be FYI only (i.e. not req on IEEE, nor a
>> statement about IEEE mechanism).  As such I remove the following
> paragraph:
>>
>> old:
>>>
>>> The WAVE protocol stack provides for strong security when using the
>>> WAVE Short Message Protocol and the WAVE Service Advertisement
>>> [ieeep1609.2-D17].
>>
>>
>> Alex
>>
>>
>>
>> _______________________________________________
>> its mailing list
>> its@ietf.org
>> https://www.ietf.org/mailman/listinfo/its
>>
>
>
>