Re: [manet] Ben Campbell's No Objection on draft-ietf-manet-dlep-26: (with COMMENT)

[Rick Taylor <[e-mail]>]

On Thu, 2016-12-15 at 08:53 -0600, Ben Campbell wrote:
> On 15 Dec 2016, at 2:45, Henning Rogge wrote:
> 
> > 
> > On Wed, Dec 14, 2016 at 5:31 PM, Ben Campbell <[e-mail]>
> > wrote:
> > > 
> > > > 
> > > > We (the co-authors) have received feedback from some radio
> > > > vendors 
> > > > stating
> > > > that a "MUST use TLS" in all cases would be a show-stopper. We
> > > > see
> > > > deployments where a small number of devices co-exist on the
> > > > LAN 
> > > > segment -
> > > > for example, a router, a line-of-sight radio, a satellite
> > > > terminal, 
> > > > and a
> > > > small number of other devices. We're open to the construction
> > > > you 
> > > > suggest,
> > > > and will discuss it.
> > > Understood. That suggests there are reasons to not _use_ TLS
> > > other 
> > > than the
> > > listed one, so "MUST unless" may not be what you want.  Any
> > > thoughts 
> > > on why
> > > TLS should not be mandatory to _implement_?
> > I might exaggerate it a little bit but I think using TLS for DLEP
> > is
> > at best a waste of time to implement. I have yet to hear about an
> > attacker model for a single hop DLEP connection (which is necessary
> > because otherwise the bridged datapath is broken!) which is not
> > easily
> > dealt with MAC-layer security.
> > 
> > At worst TLS will kill one of the most important aspects of DLEP,
> > easy
> > integration and autodiscovery of radios by different vendors to any
> > kind of router.
> > 
> > TLS also opens  can of worms (additional questions). How is the
> > DLEP
> > certificates be handled? Are there mandatory types of certificate
> > algorithms (if not, you break interoperability)? How do you secure
> > the
> > UDP part of DLEP for discovery (DTLS?) ? How do you make sure that
> > the
> > DTLS connection is to the same endpoint as the TLS connection?
> > 
> > There is a LOT of work in this direction without any gain.
> IIRC, you are arguing against even the existing "SHOULD implement" 
> requirement?
> 
> When you talk about a single-hop connection, are you assuming a
> direct 
> connection from the router to the modem, or that the router and
> modem 
> are on the same LAN segment?

Most of the discussed use-cases where TLS is viewed as unnecessary are
direct connections, but some are single-hop with an 'externally secured
perimeter'.

The authors are happy with 'SHOULD' if it removes any blocks from the
IESG, and the WG consensus is that 'MUST' will not work for
implementers.

Rick