Re: [saag] Would love some feedback on Opportunistic Wireless Encryption

On Wednesday, August 26, 2015, Viktor Dukhovni <ietf-dane@dukhovni.org>
wrote:

> On Wed, Aug 26, 2015 at 10:53:07AM -0400, Warren Kumari wrote:
>
> > I'm not sure that SAAG is the right place for it, but I couldn't think
> > of anywhere better.
> >
> > https://tools.ietf.org/html/draft-wkumari-owe-01
>
> I'm concerned that the proposal still leaves even purely passive
> adversaries able to decrypt all traffic that begin during the
> passive traffic collection interval.  This is considerably weaker
> than many other opportunistic security protocols.  With no protection
> against a passive adversary who started monitoring before the victim
> joins the network, is this still worth doing?

I believe that it is -- I think that the cost to implement this is really
really low (I added PoC "support" to OpenWRT in less than an hour, and
almost all of that was finding a suitable access point in my basement :-)).

I fully acknowledge that this doesn't solve all issues, and doesn't claim
to - but I think that for the negligible cost, the incremental security win
is worth it.

W

>
> --
>         Viktor.
>
> _______________________________________________
> saag mailing list
> saag@ietf.org <javascript:;>
> https://www.ietf.org/mailman/listinfo/saag
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf