Re: [saag] Would love some feedback on Opportunistic Wireless Encryption

[Warren Kumari <[e-mail]>]

On Wed, Aug 26, 2015 at 6:11 PM, Dan Harkins <[e-mail]> wrote:
>
>   Hi Warren,
>
> On Wed, August 26, 2015 7:53 am, Warren Kumari wrote:
>> Hi there all,
>>
>> I'd appreciate it if folk could have a look at this draft and provide
>> any feedback.
>> I'm not sure that SAAG is the right place for it, but I couldn't think
>> of anywhere better.
>>
>> https://tools.ietf.org/html/draft-wkumari-owe-01
>>
>>
>> Note that this is NOT intended to be the be all and end all of secure
>> wireless, it is simply intended to make open wifi suck somewhat less.
>> We are not claiming great security (the WPA2 4-way handshake
>> significantly limits what can be achieved), and so much of the draft /
>> idea is making sure that users do not get a false (or any) sense of
>> security - this should be transparent to them.
>
>   It might suck less but it still kind of sucks. You could make it
> suck even less by using SAE (an 802.11 authentication protocol that
> uses a PAKE to establish pairwise keys).

Hah, this will teach me to read all the mail in a thread before
replying -- I just posted something mentioning you and SAE. :-)

Does SAE work with access points or is it only defined for ad hoc /
mech networks? And if it is defined for APs, does current consumer CPE
(dlink, linksys, netgear, etc) support it?

I'd really like this to be a trivial thing for both APs and clients to
include support for, and would much rather have a crappy but better
than plaintext solution now instead of a great solution many years in
the future. I'd like to see *something* deployed, and then we can work
on improving it as time goes by...

The current document has a Sub-type field ("Sub-type identifies the
version of the OWE protocol. Currently only 0 is defined." ) - my
cunning plan was to use that (if needed) to eventually signal that the
underlying network supports something better than the current 4WHS --
although I'm guessing clients would be able to figure that out from
other information advertised by the AP.

> This would address the
> limitations you mention in your draft that have to do with WPA2-PSK.
>
>> We also want it to be *really* simple, so that commodity CPE vendors
>> will include "support" (basically a flag in the beacon) - this removes
>> other solutions like .1X, etc.
>
>   Another option might be to define another vendor-specific Element
> to carry DH exponentials. Just tag one on the end of the first two
> messages of the 4-way handshake and have each side derive a "pairwise
> master key" (PMK, the thing used with the nonces in the 4-way handshake
> to derive the data encryption keys) from the DH shared secret. Instead
> of having everyone use the SSID as the password, just get rid of the
> password!

This is probably worth discussing more, but this also feels more like
a larger scale change, and, while worth doing, I think it would be
better done in parallel...

Thank you,
W


>
>   regards,
>
>   Dan.
>
>> Appreciate your time,
>> W
>>
>> --
>> I don't think the execution is relevant when it was obviously a bad
>> idea in the first place.
>> This is like putting rabid weasels in your pants, and later expressing
>> regret at having chosen those particular rabid weasels and that pair
>> of pants.
>>    ---maf
>>
>> _______________________________________________
>> saag mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/saag
>>
>
>



-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf