Re: [homenet] HNCP security?

2014-09-17 Thread Mikael Abrahamsson
On Tue, 16 Sep 2014, Tim Chown wrote: There’s obviously some interesting implications of this. One is that there are insecure wired links too! Good point. I believe we're hitting the classic secure or easy tradeoff. There is no way we automatically can detect what is home and what is not,

Re: [homenet] HNCP security?

2014-09-17 Thread Michael Richardson
Tim Chown t...@ecs.soton.ac.uk wrote: On 16 Sep 2014, at 14:52, Michael Richardson mcr+i...@sandelman.ca wrote: I think that we can assume that wired links are secure. The only time we care if wireless is secured is when we want to form an adjacency over the

Re: [homenet] HNCP security?

2014-09-17 Thread Michael Thomas
On 09/17/2014 06:37 AM, Michael Richardson wrote: Michael Thomas m...@mtcc.com wrote: I further suggest that if two routers have wireless that they might well have a WPA2/PSK available to them, and that they can and SHOULD use something derived from that key to authenticate

Re: [homenet] HNCP security?

2014-09-17 Thread Michael Thomas
On 09/16/2014 11:31 PM, Mikael Abrahamsson wrote: As was presented in.. err, London?, shared secrets are bad. To really do this properly, we need device specific keys and some kind of list of devices that are allowed to connect, perhaps by having their public keys in HNCP. I don't know. I am

Re: [homenet] HNCP security?

2014-09-17 Thread Michael Thomas
On 9/17/14, 10:24 AM, Michael Richardson wrote: Michael Thomas m...@mtcc.com wrote: If I have more than one SSID, which PSK should the router use? Whichever ones authenticates the message. The PSK is not transmitted. I'm about to send a routing update, or whatever

Re: [homenet] HNCP security?

2014-09-17 Thread Brian E Carpenter
On 18/09/2014 02:58, Michael Thomas wrote: On 09/16/2014 11:31 PM, Mikael Abrahamsson wrote: As was presented in.. err, London?, shared secrets are bad. To really do this properly, we need device specific keys and some kind of list of devices that are allowed to connect, perhaps by having

Re: [homenet] HNCP security?

2014-09-17 Thread Mikael Abrahamsson
On Wed, 17 Sep 2014, Michael Thomas wrote: Global symmetric keys certainly have their problems, but using public keys have their own. Namely, if I want to enroll a new device each other currently enrolled device needs to know about the public key of the new enrollee. For 2 devices, that's