Re: [ipwave] draft-ietf-ipwave-ipv6-over-80211ocb-00 encryption at MAC or above LLC?

[Rex Buddenberg <[e-mail]>]

Jerome,

Right.

Scope. Encryption at layer 2 limits the scope to the network segment.
 Like the rest of the header, encryption has to be removed before
router. Similarly, L3 (and L4/L5) encryption has to be removed before
the data reaches the end system (usually in the TCP socket).  Thus the
data has no protection within the end system.  L6/7 (aka end-to-end)
can provide protection in the end system.  
     
Requirement. Further, in this set of applications, authenticity is more
important than confidentiality.  Encryption (at least using public key)
provides no authenticity.  

I think the interoperability requirements will make encryption at any
layer below 6 to be very difficult to scale.  By the time you've gotten
everybody who needs the keys properly endowed, you've gotten keys into
the hands of those you didn't want.

b



On Fri, 2017-02-03 at 14:50 +0100, Jérôme Härri wrote:
> Hello Alex,
> 
> I agree with you. Encryption can only be done at L3 and above in our
> case, as OCB disconnects any security mechanisms at the MAC layer and
> it is possible for IETF to make changes to a lower layer. 
> 
> And I would more generally tend to think that encryption should be
> 'end-2-end', so at a service/application layer (e.g. IoT
> applications)... MAC headers will be sent in clear, and the question
> would be: what would we need to transmit at the L3 layer, which would
> not be coming from a higher layer (thus L3 headers), and which would
> need to be encrypted? 
> 
> Nevertheless, we should leave the possibility to encrypt at L3 (as
> you suggest), although I have the feeling that encryption will
> actually be done at an application level.
> 
> Best Regards,
> 
> Jérôme 
> 
> -----Original Message-----
> From: its [mailto:[e-mail]] On Behalf Of Alexandre
> Petrescu
> Sent: Friday 03 February 2017 13:56
> To: [e-mail]
> Subject: [ipwave] draft-ietf-ipwave-ipv6-over-80211ocb-00 encryption
> at MAC or above LLC?
> 
> draft-ietf-ipwave-ipv6-over-80211ocb-00
> encryption at MAC or above LLC?
> 
> Hello IPWAVErs,
> 
> A question was raised about whether encryption would take place at
> MAC layer or above the LLC layer (i.e. IP layer)?
> 
> My answer is that encryption should be performed at at least at the
> IP layer, namely IPsec and Encapsulated Security Payload (ESP)
> header.
> 
> The details about how the encryption is performed should be described
> in a different I-D.
> 
> But in the IPv6/OCB draft we can tell that "encryption MAY be
> performed at least in the IPsec layer (and potentially in the MAC
> layer as well)".
> 
> Alex
> 
> 
> _______________________________________________
> its mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/its