Re: [saag] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt
Stephen Farrell <stephen.farrell@cs.tcd.ie> Wed, 29 July 2015 13:28 UTC
Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0FD01A000E for <saag@ietfa.amsl.com>; Wed, 29 Jul 2015 06:28:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.311
X-Spam-Level:
X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PZmhk0AlbjYW for <saag@ietfa.amsl.com>; Wed, 29 Jul 2015 06:28:18 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3B2D1A020A for <saag@ietf.org>; Wed, 29 Jul 2015 06:28:17 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id BE643BE7D; Wed, 29 Jul 2015 14:28:16 +0100 (IST)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rX9VM_YuwTL3; Wed, 29 Jul 2015 14:28:15 +0100 (IST)
Received: from [10.87.48.73] (unknown [86.46.19.103]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9ADD8BE53; Wed, 29 Jul 2015 14:28:14 +0100 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1438176495; bh=sOb6cc6197CtaZINiad6754614/NadsWodxDKPUM9lg=; h=Date:From:To:CC:Subject:References:In-Reply-To:From; b=Ob2ZYpIwLxef9upTDzJYSE5rCiVce3yrWqP1CoLx82Wtqs5G0KYsRookU1kuXzFv5 P6rd8LPMchoYIuxMlvtGVKz5NzAQp9AQE+YpA2kq1tKsDlWt39TGUXGMaxYEf5y+u8 vHHfkJYkd8eusR1Ymeo/Kw3teLtx7ZpBo75XTC3M=
Message-ID: <55B8D4EE.8040903@cs.tcd.ie>
Date: Wed, 29 Jul 2015 14:28:14 +0100
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0
MIME-Version: 1.0
To: Lishan Li <lilishan48@126.com>
References: <313da830.6be8.14ed8564467.Coremail.lilishan48@126.com> <m2mvyfh1re.wl%randy@psg.com> <55B8A692.8080409@cs.tcd.ie> <3c4ad4b5.e9ed.14ed9fd3c2a.Coremail.lilishan48@126.com>
In-Reply-To: <3c4ad4b5.e9ed.14ed9fd3c2a.Coremail.lilishan48@126.com>
OpenPGP: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/saag/a3Z6FuZnWBNOoffytTzimzo5XEo>
Cc: cuiyong@tsinghua.edu.cn, Security Area Advisory Group <saag@ietf.org>
Subject: Re: [saag] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Jul 2015 13:28:21 -0000
On 29/07/15 14:25, Lishan Li wrote: > Dear Stephen, > > > Thanks very much for your kind reply. I am considering whether the > "Opportunistic Security" can be used. The opportunistic security make > use of the encryption more broadly, authentication is optional. What > do you think of the opportunistic security? I think OS is a fine thing. I don't know for sure how or if it's useful for DHCP though, since I'm yet another person who's not done the analysis of that;-) S. > > > Best Regards, Lishan At 2015-07-29 18:10:26, "Stephen Farrell" > <stephen.farrell@cs.tcd.ie> wrote: >> >> Hi Randy, >> >> On 29/07/15 08:16, Randy Bush wrote: >>> this document, like the v4 dhc document, is all mechanism with no >>> clear statement of applicability. neither document discusses key >>> distribution and management, the usual critical fulcrum of >>> symmetric and asymetric key-based mechanisms. e.g. how does this >>> work in a coffee shop? and the answer better not be tofu and >>> leap of faith. >> >> I'm not keen on that kind of argument tbh where we say "show me >> your threat model and btw <this> better not be it." Can you Randy >> show me a good analysis of how different kinds of key management >> have which consequences for DHCP authentication and >> confidentiality? I don't believe I've seen that documented myself >> but I've not spent time looking specifically for it. In this case >> the authors are looking to us for help with getting that done, and >> I don't believe poking them like that is either useful or fair, >> sorry. >> >> As for TOFU, I do believe there may be a role for that in DHCP. >> There are cases where I informally start to use a sadly-open WiFi >> n/w and continue to use that for a few days or sporadically (e.g. >> a friend's guest WiFi) and in such cases TOFU could provide some >> protection to some or maybe most of the population using such a >> network. (And even if my friend has WPA turned on, TOFU for DHCP >> might protect me from their clever kid who was in school when I >> arrived;-) It'd also not be reasonable to expect my friend to have >> asked permission from a CA before setting up the guest WiFi. >> >> And yes, there are enterprise cases where a local PKI could and >> maybe should be used instead. And yes one could argue that WiFi >> roaming arrangements and large franchises (e.g. starbucks) should >> find a way to put certs in place, but I'm not convinced that doing >> nothing until we reach that goal is reasonable. I am fairly >> convinced that always requiring use of a PKI would result in fairly >> ubiquitous lack of use. >> >> There may even be good arguments based on the nature of DHCP to >> the effect that I'll have to accept what TOFU would tell me to >> reject, but I also don't think I've seen that either. (When my >> putative friend above buys a new AP/DHCP-server that would be an >> issue for either TOFU or a PKI based answer, but perhaps not an >> insurmountable one in either case.) >> >> But we (the IETF) have a really bad history with DHCP security in >> that RFC 3118 [1] is perhaps the most commonly cited unused >> security RFC. One could I think claim it wins the security-BS >> contest for RFCs even shoving the evil bit down into 2nd place;-) >> >> Forty-seven (yes 47! [2]) other RFCs reference 3118 and that >> mostly means pretending to provide security via a reference that >> the authors fully know is BS. I have checked a number of times with >> such authors and 3118 seems comprehensively unused. I only ever got >> one .mil type person saying that they use it but he wasn't allowed >> say more. Nobody else has ever told me that they can or do use >> 3118. In fact, in most cases when I see a reference to 3118 as a >> security mechanism, I'll put on a DISCUSS ballot to call the >> authors out for the BS. And in many cases we find they just copied >> it from somewhere hoping it'd shut-up the security ADs;-) >> >> We can certainly improve on that sad state. And I would say that >> TOFU is a credible part of that until evidence or detailed >> argument to the contrary is produced, which you have yet to do. >> >> S. >> >> [1] https://tools.ietf.org/html/rfc3118 [2] >> http://www.arkko.com/tools/allstats/citations-rfc3118.html >> >> >>> >>> randy >>> >>> _______________________________________________ saag mailing >>> list saag@ietf.org https://www.ietf.org/mailman/listinfo/saag >>>
- [saag] Fw:Fw:New Version Notification for draft-c… Lishan Li
- Re: [saag] Fw:Fw:New Version Notification for dra… Randy Bush
- Re: [saag] Fw:Fw:New Version Notification for dra… Stephen Farrell
- Re: [saag] Fw:Fw:New Version Notification for dra… Randy Bush
- Re: [saag] Fw:Fw:New Version Notification for dra… Lishan Li
- Re: [saag] Fw:Fw:New Version Notification for dra… Stephen Farrell
- Re: [saag] Fw:Fw:New Version Notification for dra… Stephen Farrell
- Re: [saag] Fw:Fw:New Version Notification for dra… Lishan Li
- Re: [saag] Fw:Fw:New Version Notification for dra… Stephen Farrell
- Re: [saag] Fw:Fw:New Version Notification for dra… Randy Bush
- Re: [saag] Fw:Fw:New Version Notification for dra… Christian Huitema
- Re: [saag] Fw:Fw:New Version Notification for dra… Lishan Li
- Re: [saag] [dhcwg] Fw:Fw:New Version Notification… Erik Kline
- Re: [saag] Fw:Fw:New Version Notification for dra… ianG
- Re: [saag] Fw:Fw:New Version Notification for dra… Randy Bush
- Re: [saag] New Version Notification for draft-cui… Alan DeKok
- Re: [saag] New Version Notification for draft-cui… Alan DeKok
- Re: [saag] New Version Notification for draft-cui… Bernard Aboba
- Re: [saag] New Version Notification for draft-cui… Alan DeKok
- Re: [saag] New Version Notification for draft-cui… Randy Bush
- Re: [saag] New Version Notification for draft-cui… Sam Hartman
- Re: [saag] Fw:Fw:New Version Notification for dra… Nico Williams
- Re: [saag] Fw:Fw:New Version Notification for dra… Nico Williams
- Re: [saag] New Version Notification for draft-cui… Alan DeKok
- Re: [saag] [dhcwg] Fw:Fw:New Version Notification… 李丽姗