Re: [ipwave] draft-ietf-ipwave-ipv6-over-80211ocb-00 encryption at MAC or above LLC?

[Jérôme Härri <[e-mail]>]

Hello Alex,

I agree with you. Encryption can only be done at L3 and above in our case, as OCB disconnects any security mechanisms at the MAC layer and it is possible for IETF to make changes to a lower layer. 

And I would more generally tend to think that encryption should be 'end-2-end', so at a service/application layer (e.g. IoT applications)... MAC headers will be sent in clear, and the question would be: what would we need to transmit at the L3 layer, which would not be coming from a higher layer (thus L3 headers), and which would need to be encrypted? 

Nevertheless, we should leave the possibility to encrypt at L3 (as you suggest), although I have the feeling that encryption will actually be done at an application level.

Best Regards,

Jérôme 

-----Original Message-----
From: its [mailto:[e-mail]] On Behalf Of Alexandre Petrescu
Sent: Friday 03 February 2017 13:56
To: [e-mail]
Subject: [ipwave] draft-ietf-ipwave-ipv6-over-80211ocb-00 encryption at MAC or above LLC?

draft-ietf-ipwave-ipv6-over-80211ocb-00
encryption at MAC or above LLC?

Hello IPWAVErs,

A question was raised about whether encryption would take place at MAC layer or above the LLC layer (i.e. IP layer)?

My answer is that encryption should be performed at at least at the IP layer, namely IPsec and Encapsulated Security Payload (ESP) header.

The details about how the encryption is performed should be described in a different I-D.

But in the IPv6/OCB draft we can tell that "encryption MAY be performed at least in the IPsec layer (and potentially in the MAC layer as well)".

Alex