Subject: [Geopriv] Brian Rosen on location signing

From: Andrew Newton <[email-masked]>
Date: Fri, 9 Mar 2007 15:33:31 -0500

Since I just spent the last half hour reviewing the mailing list  
traffic on location signing in my role as co-chair, I found that  
Brian Rosen made a couple of points that were very interesting but  
also lightly supported.  And I tend to wonder why, since he supports  
location signing.

Point 1. Location signing is much more than an L7-LCP issue.  It also  
changes location conveyance and de-referenced locations.  Is there  
anybody that disagrees with this?  Do participants realize this?

Point 2. Brian has asserted that location signing should be applied  
to all location configuration protocols, not just L7-LCP.  His  
assertion is that location signing for the emergency use case is  
applicable no matter how a UA acquires their location information.   
This brings up the question, if the other proponents of location  
signing feel it is important to deter spoofing, DoS, etc, why isn't  
location signing always important no matter how it is required?

-andy

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Richard Barnes <[email-masked]>
Date: Fri, 09 Mar 2007 15:57:37 -0500

I would second Brian on those points.  If we can agree that signed 
location objects are useful, then we should have a signed location 
object structure that's common across protocols, just like PIDF-LO is 
used for location across protocols.
--RB

Andrew Newton wrote:
> Since I just spent the last half hour reviewing the mailing list traffic 
> on location signing in my role as co-chair, I found that Brian Rosen 
> made a couple of points that were very interesting but also lightly 
> supported.  And I tend to wonder why, since he supports location signing.
> 
> Point 2. Brian has asserted that location signing should be applied to 
> all location configuration protocols, not just L7-LCP.  His assertion is 
> that location signing for the emergency use case is applicable no matter 
> how a UA acquires their location information.  This brings up the 
> question, if the other proponents of location signing feel it is 
> important to deter spoofing, DoS, etc, why isn't location signing always 
> important no matter how it is required?
> 
> -andy
>

---

From: "Winterbottom, James" <[email-masked]>
Date: Fri, 9 Mar 2007 17:00:06 -0600

I am not in complete agreement with this position though I am a
proponent of location signing.
The standard container for location information in this forum is the
PIDF-LO, and this is something that we can easily address the signing
of.

Attempting to come up with a signing mechanism that can support any
number of binary encoding schemes seems to me to be counter productive
and will likely have problems from a future-proofing perspective.

Signing a PIDF-LO can provide the following characteristics:
1) ties location to end-device
2) ties signature to access provider
3) ties end-device to location at specific point in time
4) ties location to end-device for recipient if used with a conveyance
identity mechanism.

It is unclear to me how you can achieve these things if all you get is a
location element and a signature. There is a proposal on the table now
for how this can be done with a PIDF-LO, there has been talk over
signing LCI for nearly 2 years but not proposal has yet been made, and
it has is unclear precisely what would be signed, and how it would
address the 4 points above.

Cheers
James

> -----Original Message-----
> From: Richard Barnes [mailto:[email-masked]]
> Sent: Saturday, 10 March 2007 7:58 AM
> To: Andrew Newton
> Cc: GEOPRIV WG
> Subject: Re: [Geopriv] Brian Rosen on location signing
> 
traffic
> > Point 2. Brian has asserted that location signing should be applied
to
> > important no matter how it is required?

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: "Dawson, Martin" <[email-masked]>
Date: Fri, 9 Mar 2007 18:12:00 -0600

Yes  - it seems to me that I could similarly argue that we all agree
that location conveyance is of critical importance, therefore the SIP
conveyance specification should go back to the drawing board and cover
location provided in other forms as well.

The assertion mechanism is available for location obtained from a link
layer source - currently LLDP-MED or DHCP but also possible according to
the latest IEEE specs for WiFi. The device can obtain the precise
location from the link and ask the LIS to sign it via assertion. This
makes it equivalent to any self-determination capability such as GPS or
RFID beacon measurement.

BTW, assertion is another function to add to the list Andy.

Cheers,
Martin

-----Original Message-----
From: Winterbottom, James [mailto:[email-masked]] 
Sent: Saturday, 10 March 2007 10:00 AM
To: Richard Barnes; Andrew Newton
Cc: GEOPRIV WG
Subject: RE: [Geopriv] Brian Rosen on location signing

Cheers
James

traffic
to
> > important no matter how it is required?

------------------------------------------------------------------------
------------------------
------------------------------------------------------------------------
------------------------
[mf2]

---

From: Richard Barnes <[email-masked]>
Date: Fri, 09 Mar 2007 19:33:19 -0500

James,

Maybe not with just a LO and a signature.  But there's only a few 
interesting bindings that one might want to indicate with these 
structures (you give four), so it seems like we could come up with 
something sufficiently expressive to cover those.

--RB

Winterbottom, James wrote:
>>> Point 1. Location signing is much more than an L7-LCP issue.  It
> als
> ed locations.  Is there

---

From: Michael Haberler <[email-masked]>
Date: Sat, 10 Mar 2007 09:40:03 +0100

I would second Brian on signing as well.

I've done a back-of-the-envelope calculation - 10 certificates would  
cover more than 97% of all IP-capable public access  in Austria. That  
approach looks manageable - thanks to  PSAP/access locality (and  
market consolidation ;-).

As for the corporate network and occasional access point - well a  
certificate with *some* local recognition already helps, I dont think  
every plastic box needs a cert from the PSAP CA proper. It's an 80/20  
thing - or more like to give 99/1 with modest effort.

-Michael

I'd love a check  "I have set up my new access point and added a  
certificate - I click the "verify setup" button and would see if/how  
much the signed location would be trusted". how could that be done?

Am 09.03.2007 um 21:57 schrieb Richard Barnes:

> object structure that's common across protocols, just like PIDF-LO  
> is used for location across protocols.
> --RB
>
> Andrew Newton wrote:
>> also lightly supported.  And I tend to wonder why, since he  
>> supports location signing.
>> also changes location conveyance and de-referenced locations.  Is  
>> there anybody that disagrees with this?  Do participants realize  
>> this?
>> Point 2. Brian has asserted that location signing should be  
>> applied to all location configuration protocols, not just L7-LCP.   
>> His assertion is that location signing for the emergency use case  
>> is applicable no matter how a UA acquires their location  
>> information.  This brings up the question, if the other proponents  
>> of location signing feel it is important to deter spoofing, DoS,  
>> etc, why isn't location signing always important no matter how it  
>> is required?
>> -andy

---

From: "Dawson, Martin" <[email-masked]>
Date: Sat, 10 Mar 2007 06:54:18 -0600

Hi Michael,

How are you connecting your access point to the Internet? If it's with a
public provider, you probably don't need to do anything with
certificates. Devices will discover the provider's LIS and it will look
after getting the location signed. Oh - I see, you're talking about a
public provider setting up a point of access - presumably for the first
time with LIS functionality?

As for an automatic test - yes, that would be nice. In testing 9-1-1 for
cellular these days, we (including the cellular operator) have to set up
a fair bit of infrastructure and network configuration to be able to
dial an emergency call from arbitrary network locations and test as much
of the emergency application (call initiation, location determination,
routing, and location reporting) as possible without actually bothering
the PSAPs.

It would certainly be nice if you could do an "emergency services" ping
that did everything other than bother any humans - perhaps get a report
back indicating where it thought you were, who your network provider
was, if your location information looked valid and trusted and anything
else they thought would be safe to tell you.

All of which would have been a more appropriate aside for the ECRIT list
I suppose.

Cheers,
Martin

-----Original Message-----
From: Michael Haberler [mailto:[email-masked]] 
Sent: Saturday, 10 March 2007 7:40 PM
To: Richard Barnes
Cc: GEOPRIV WG; Andrew Newton
Subject: Re: [Geopriv] Brian Rosen on location signing

-Michael

---

From: Michael Haberler <[email-masked]>
Date: Sat, 10 Mar 2007 14:10:21 +0100

> certificates. Devices will discover the provider's LIS and it will  

You are right.

I was implicitely thinking about an standalone early  deployment/demo  
scenario.

Takeup with access providers will take its time, and it might be  
handy to have say an OpenWRT package to demo/deploy the whole chain  
without assuming public provider LIS availability. That could be  
turned off eventually.

-Michael

---

From: "Brian Rosen" <[email-masked]>
Date: Sat, 10 Mar 2007 08:51:19 -0500

> much the signed location would be trusted". how could that be done?

Please see "Chapter 13  Testing" in draft-ietf-ecrit-framework-01
Probably we need some more error resolution.

---

From: Andrew Newton <[email-masked]>
Date: Tue, 13 Mar 2007 10:39:45 -0400

James,

There are two issues here.  One is about the requirement for location  
signing and the other is about technical details to accomplish  
location signing.  The first is the issue I brought up based on  
Brian's comment, and the second is the issue you just brought up.

1) The justification for location signing has been about the non- 
spoofability of the location information.  What I was noting was that  
if you believe so heavily in this requirement, then how can you  
justify location signing only for access networks that use L7-LCP and  
not those access networks that use DHCP, LLDP-MED, or other methods.   
If the justification is so important, shouldn't the problem be solved  
for those other access networks?

2) XML D-Sig has historically been no panacea.  Many other SDOs have  
had to create or find other XML canonicalization methods.  Perhaps  
the W3C has fixed this problem with a canonicalization specification  
that is more universal.  As an example, the UDDI consortium struggled  
with which canonicalization specification to use.  I've heard about  
this many other times.  We were advised of these issues when we  
created RFC 4119 by the security area advisor.

What I believe Brian has suggested is a canonicalization method that  
works across XML and the binary formats.  Yes, this would be  
something we had to specify, but it doesn't sound unachievable since  
we know how location information can be represented in both forms.   
Taking the data, putting in canonical form to run a crypto signature  
over it, and passing that signature on is not an effort much greater  
than what you are suggesting.

-andy

On Mar 9, 2007, at 6:00 PM, Winterbottom, James wrote:

> also

---

From: "Dawson, Martin" <[email-masked]>
Date: Tue, 13 Mar 2007 10:21:07 -0500

Well I think that'd be great. I'd certainly prefer to discuss ways to
unify the ways to sign location than to spend time arguing about whether
we are going to let the end users have location signing to begin with.

DHCP and LLDP-MED are essentially the same form of location
representation right and they don't use PIDF-LO as do at least some of
the candidate "L7" (I really hate the label) protocols do?

Now - SIP conveyance assumes a PIDF-LO form and, certainly, the NENA i2
architecture stated PIDF-LO as the standard representation.

What would the mechanics be, then, between the point of querying the
DHCP server or LLDP-MED-enabled switch port for location and the point
of dispatching the PIDF-LO in the SIP signalling? That is where and how
could the signature components be generated and transported?

Cheers,
Martin

-----Original Message-----
From: Andrew Newton [mailto:[email-masked]] 
Sent: Wednesday, 14 March 2007 1:40 AM
To: Winterbottom, James
Cc: GEOPRIV WG
Subject: Re: [Geopriv] Brian Rosen on location signing

James,

-andy

On Mar 9, 2007, at 6:00 PM, Winterbottom, James wrote:

> ----------------------------------------------------------------------

> --------------------------
> ----------------------------------------------------------------------

> --------------------------
> [mf2]
>

---

From: Andrew Newton <[email-masked]>
Date: Tue, 13 Mar 2007 11:52:45 -0400

> we are going to let the end users have location signing to begin with.

Certainly, one answer is to say "let us go forward with the caveats  
given; if it is unworkable in the field we'll have no choice than to  
find another solution."

> the candidate "L7" (I really hate the label) protocols do?

I believe that is correct.

> could the signature components be generated and transported?

Well, there could be a new DHCP option for requesting the signature.   
This signature could then be put in an element in PIDF-LO such as  
<sig4119:signature>.......</sig4119:signature>.  If an L7 protocol  
populates that element, it would mean it went through the same  
process for canonicalizing and signing the data.

-andy

---

From: "Winterbottom, James" <[email-masked]>
Date: Tue, 13 Mar 2007 15:56:26 -0500

> process for canonicalizing and signing the data.

I think that there are a few details that would need to be worked out
here.
For example, if I request both geodetic and civic information, what is
the signature applied to? Do I need two signature options one for each?

---

From: "Dawson, Martin" <[email-masked]>
Date: Tue, 13 Mar 2007 18:33:19 -0500

That sounds good to me. It also goes to the other discussion we were
having on this list about signing an entire PIDF-LO versus just the part
that the location server has provided. Your description implies the
latter and I think it's the correct approach. That way the location
server isn't making any statements with respect to PIDF-LO content that
is outside its scope of authority.

I think there may be a technical issue. The signature needs to be done
on the hash of the actual location data. There's a transform involved in
going from the RFC3825 form to the PIDF-LO form. Unless the PIDF-LO also
carried the original form (for signature validation) the end point would
need to reverse-code the PIDF form before checking the signature.
Thoughts?

Cheers,
Martin

-----Original Message-----
From: Andrew Newton [mailto:[email-masked]] 
Sent: Wednesday, 14 March 2007 2:53 AM
To: Dawson, Martin
Cc: Winterbottom, James; GEOPRIV WG
Subject: Re: [Geopriv] Brian Rosen on location signing

-andy

---

From: Andrew Newton <[email-masked]>
Date: Tue, 13 Mar 2007 21:34:39 -0400

> the signature applied to? Do I need two signature options one for  

Obviously the details need to be worked out, but they do not sound  
insurmountable.

-andy