[secdir] Advice on pairing specification, TLS, etc.

["Christian Huitema" <[e-mail]>]

Sometimes, one thing leads to another. Daniel and I are working in the
DNS-SD working group on a specification for "private discovery". The idea is
that you come to some open space, say a Wi-Fi hot spot, and you can find
your buddies. But the process is kept private, so that third parties cannot
find out who you are, and only your "friends" can discover and access the
services that you are publishing. That was the first thing. It is specified
in https://datatracker.ietf.org/doc/draft-huitema-dnssd-privacy/. But the
specification assumes that the devices that can be discovered have gone
through a "pairing" process, in order to set up some PSK that is then used
to obfuscate the discovery and secure access to the services. Which is how
it led to the next step, specifying a pairing system.

We are giving it a shot. The first version of the pairing draft is at
https://datatracker.ietf.org/doc/draft-kaiser-dnssd-pairing/. It specifies
how to set up a pairing using TLS with [EC]DH anon, then exchange random
numbers using a commitment before disclosure protocol, so that the
verification of a Short Authentication String provides robustness against
MITM. But we have plenty of questions. Should we specify the protocol as an
extension to TLS, as was once proposed in
https://tools.ietf.org/html/draft-miers-tls-sas-00, a draft that is now
expired? Should we use TLS resume tickets instead of passwords? 

The DNS-SD working group is probably not well equipped to look at these
issues. Would some participants to SAAG give us advice?

-- Christian Huitema