Re: [saag] Would love some feedback on Opportunistic Wireless Encryption

[Warren Kumari <[e-mail]>]

On Wed, Aug 26, 2015 at 2:30 PM, Henry B (Hank) Hotz, CISSP
<[e-mail]> wrote:
>
>> On Aug 26, 2015, at 7:53 AM, Warren Kumari <[e-mail]> wrote:
>>
>> I'd appreciate it if folk could have a look at this draft and provide
>> any feedback.
>
> I agree with the argument that the minimal effort makes it worth doing.
>
> OTOH, I also agree that something you can’t break passively would be better. How about a connection that’s negotiated with D-H key exchange, but you never verify identities? (Hmmm, is there an EAP mech that would effectively do that?)
>
> How hard will it be to get AP makers to adopt whatever is proposed? Is the additional difficulty of DH really a dealbreaker?

Unfortunately I believe that it probably is a deal breaker, or, at
least, would take so much time that it wouldn't be worth doing.

I believe that the right place to do this sort of work (adding public
key agreement) is in the IEEE, probably in the 802.11 group. I am not
participating in the IEEE at the moment, but am beginning to wonder if
I should participate and see if a public key agreement can be added to
WPA. Adhoc / mesh networks already have a solution to this
("Simultaneous Authentication of Equals" (SAE - 802.1s)). I'm guessing
that there is a good reason that is isn't also in normal wifi; I
believe that Dan Harkins was deeply involved in the development of SAE
- perhaps he can shed some light on this?

W

>
> Personal:  [e-mail]
> Business: [e-mail]
>



-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf