Re: [secdir] secdir review of draft-ietf-dhc-access-network-identifier-08

[Daniel Kahn Gillmor <[e-mail]>]

On Mon 2015-07-27 12:24:36 -0400, Sri Gundavelli (sgundave) wrote:

> "The information elements that this draft is exposing is the client’s
> access-network information. These pertains to the access network to
> which the client is attached, such as Access Technology Type (Ex:
> WLAN, Ethernet…etc), Access Point Identity (Name, BSSID), Operator
> Id/Realm. Exposing these information elements to an eavesdropper has
> no implication on the end-user security.

This last sentence seems like a bold claim.  Consider a large office
with 20 rooms, a dozen access points, a handful of DHCP relays, and one
DHCP server, with an attacker on the network near the server who wants
to attack any device located in a particular conference room (maybe
there's a meeting going on that they want to listen in on).  Doesn't
exposing the access network information allow such an attacker to target
their attack more effectively?  this seems to have an implication for
end-user security to me.

You imply as much with the next sentence:

> But, in deployments where this information is considered secure and
> when such threat cannot be mitigated using IPsec [RFC4301] or other
> security protocols, then the administrators have to consider disabling
> the capability specified in this document on the DHCP entities."

Maybe just drop the claim that exposing these elements has no
implication for end-user security and keep the rest of the guidance?

There are also potential privacy implications to transmitting this
information, in that it allows tracking of individual devices across
access points by anyone able to record/read the DHCP stream, and those
privacy implications have security consequences as well.  Want to know
when Jane has taken her mobile phone to the lunchroom, leaving her
desktop computer unattended?  Just listen in to the DHCP stream...

Regards,

            --dkg