[Lsvr] lsoe security: tofu, hierarchy, ...?

[Randy Bush <[e-mail]>]

so it's time to get serious about lsoe security.

currently, the OPEN PDU contains a variable length Authentication Data
blob.

we want to sign all PDUs; though maybe not the KEEPALIVE.  as KEEPALIVEs
are frequent, we may want to keep them small and not have the crypto
overhead of validating them.  worth discussing.

i have repeatedly asked for the threat model behind folk's desire for
PDU security.  perhaps an illustration of two possible paths would help
clarify why i am undecided.

    Trust On First Use, AKA TOFU: the OPEN might have a key, symmetric
    or asymmetric, which is automaticaly trusted by the other party, and
    is used to sign all subsequent PDUs.  the security provided is that
    you know you are talking to the same party as the one with whom you
    OPENed.

    CA Hierarchy: the clos could have a CA which signs per-device
    certificates.  each device would have a (chain to the) root cert by
    which it could verify the public key in the OPEN and all PDU
    signatures.  this provides a stronger trust model than TOFU, but is
    more complex in that one has to maintain a CA hierarchy, have good
    key signing and distribution mechanisms, anticipate key rolls, etc.

surely there are other models.  i am just trying to illustrate.

i have this fantasy about finessing the draft in such a way that either
could be used.  but fear that the result would be underspecified to the
extent that security reviewers would not be happy.

feedback time!

randy