Re: [homenet] Please review security considerations of draft-homenet-babel-profile

2017-07-25 Thread Juliusz Chroboczek 
> ...one might recommend starting with "an upper-layer security protocol"
> such as CMS, COSE, JOSE or some other layer-3 encapsulation.  

We're planning to use DTLS for both HNCP and Babel.

But the authentication mechanism is not our main concern.  This being
Homenet, we need to generate keys automatically and distribute them
securely with little or no user intervention.  This is not trivial to do
right, and requires carefully balancing the tradeoffs between security and
usability.

-- Juliusz

___
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet

Re: [homenet] Please review security considerations of draft-homenet-babel-profile

2017-07-25 Thread Mark Baugher 

> On Jul 25, 2017, at 1:27 PM, Juliusz Chroboczek  wrote:
> 
> Dear all,
> 
> All security wizards are kindly requested to carefully read and if
> necessary criticise the following section:
> 
>  https://tools.ietf.org/html/draft-ietf-homenet-babel-profile-02#section-4

Based on this paragraph...
"If untrusted links are used for transit, which is NOT RECOMMENDED,
   and therefore need to carry HNCP and Babel traffic, then HNCP and
   Babel MUST be secured using an upper-layer security protocol.  While
   both HNCP and Babel support cryptographic authentication, at the time
   of writing no protocol for autonomous configuration of HNCP and Babel
   security has been defined."

...one might recommend starting with "an upper-layer security protocol"
such as CMS, COSE, JOSE or some other layer-3 encapsulation.  

Mark

> 
> Nasty comments on list, please, compliments by private mail ;-)
> 
> Thanks,
> 
> -- Juliusz
> 
> ___
> homenet mailing list
> homenet@ietf.org
> https://www.ietf.org/mailman/listinfo/homenet

___
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet

Re: [homenet] Please review security considerations of draft-homenet-babel-profile

2017-07-25 Thread Ray Bellis 


On 25/07/2017 22:58, Stephen Farrell wrote:

> I suggest asking the chairs to hit the "request directorate" review
> (iirc only they can see that button?) for an early secdir review.

Good idea - I've just done this.

Ray

___
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet

Re: [homenet] Please review security considerations of draft-homenet-babel-profile

2017-07-25 Thread Juliusz Chroboczek 
> 1) The first sentence seems to not say what to do if a packet comes
> from a 1918 IPv4 address. Even if that's not supposed to happen, it
> could be attempted. What's an implementation supposed to do then?

Both HNCP and Babel use IPv6 for carrying control data.  There's no way an
IPv4 packet can be received by them (barring bugs, of course).  See also
REQ1 in this draft.

> 2) Again I need to read the rest of the draft, but does this mean
> that anyone on that link of the homenet can inject these messages
> without any authentication,

On the trusted link, yes.

> and if so why is that ok?

This draft takes no stand on whether it is okay or not, it merely states
the current security situation.  Defining cryptographic authentication
mechanisms for the Homenet stack is out of scope for this draft.

-- Juliusz

___
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet

Re: [homenet] Please review security considerations of draft-homenet-babel-profile

2017-07-25 Thread Stephen Farrell 

Hiya,

I suggest asking the chairs to hit the "request directorate" review
(iirc only they can see that button?) for an early secdir review.

For myself, I've not read the draft yet (I will over the next few
weeks) but have two questions while I'm here:

1) The first sentence seems to not say what to do if a packet comes
from a 1918 IPv4 address. Even if that's not supposed to happen, it
could be attempted. What's an implementation supposed to do then?

2) Again I need to read the rest of the draft, but does this mean
that anyone on that link of the homenet can inject these messages
without any authentication, and if so why is that ok? (I'm not
asking for now why doing better is too hard, just why it's ok for
any node on link to be able to play here.)

Cheers,
S.

On 25/07/17 21:27, Juliusz Chroboczek wrote:
> Dear all,
> 
> All security wizards are kindly requested to carefully read and if
> necessary criticise the following section:
> 
>   https://tools.ietf.org/html/draft-ietf-homenet-babel-profile-02#section-4
> 
> Nasty comments on list, please, compliments by private mail ;-)
> 
> Thanks,
> 
> -- Juliusz
> 
> ___
> homenet mailing list
> homenet@ietf.org
> https://www.ietf.org/mailman/listinfo/homenet
> 



signature.asc
Description: OpenPGP digital signature
___
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet

[homenet] Please review security considerations of draft-homenet-babel-profile

2017-07-25 Thread Juliusz Chroboczek 
Dear all,

All security wizards are kindly requested to carefully read and if
necessary criticise the following section:

  https://tools.ietf.org/html/draft-ietf-homenet-babel-profile-02#section-4

Nasty comments on list, please, compliments by private mail ;-)

Thanks,

-- Juliusz

___
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet