Subject: Re: [homenet] HNCP security?

From: Randy Turner <[email-masked]>
Date: Thu, 18 Sep 2014 17:43:41 -0500

Are we assuming that the home router is purchased retail, and not "fulfilled" or provided by an ISP? The method to establish trust relationships would hinge on the answer

Randy

-------- Original message --------
From: Mark Baugher <[email-masked]> 
Date:09/18/2014  5:12 PM  (GMT-06:00) 
To: Randy Turner <[email-masked]> 
Cc: "[email-masked] Group" <[email-masked]> 
Subject: Re: [homenet] HNCP security? 

On Sep 18, 2014, at 2:37 PM, Randy Turner <[email-masked]> wrote:

> How do you bootstrap trust relationships without an initial certificate (whether installed at manufacturing or during a customer fulfillment stage) ?

One way is through a user "security ceremony" (viz. Walker and Ellison) in the Wi-Fi and UPnP standards: The user pushes a recites a password, pushes buttons, waves an NFC device, etc. to authorize, e.g. sign the router's self-signed cert so other routers will accept its HNCP.  That's a root of trust model.  I'm sure there are other such models.  There's been some talk about using web of trust, but I don't understand how that would work.

Mark

> 
> 
> 
> -------- Original message --------
> From: Michael Thomas <[email-masked]> 
> Date:09/18/2014 4:17 PM (GMT-06:00) 
> To: [email-masked] 
> Cc: 
> Subject: Re: [homenet] HNCP security? 
> 
> 
> On 9/18/14, 2:10 PM, STARK, BARBARA H wrote:
> >> Self-signed certs bring only confusion, IMO: they are nothing more than a
> >> raw key with an unsubstantiated claim to another name, along with a whole
> >> lot more ASN.1 baggage beyond what is needed to parse the modulo and
> >> exponent.
> >>
> >> And you don't get usage or policy restrictions without a CA that the
> >> *HOMENET* trusts to assert them, nor can that sort of policy assertion be
> >> done with device certs since I don't have any reason to believe fly-by-night's
> >> routers should be allowed to do whatever it is they claim they want to do.
> > No, this would only be true if there were an implied authorization to go along with the authentication.
> 
> Yes, I agree and that's why self-signed and/or manufacturer certs are of 
> no help.
> There is no believable authz in them. A homenet would need to run its 
> own CA, or
> use a CA that it delegates authz to. Or does something that avoids certs 
> altogether
> and provides its own enrollment/authz solution.
> 
> Mike
> 
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet
> 
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet

---

From: Michael Thomas <[email-masked]>
Date: Thu, 18 Sep 2014 15:47:06 -0700

On 9/18/14, 3:43 PM, Randy Turner wrote:
> Are we assuming that the home router is purchased retail, and not 
> "fulfilled" or provided by an ISP? The method to establish trust 
> relationships would hinge on the answer
>

I should be able prepurpose an old PC with linux running homenet 
software. We can
make no assumptions about where my PC came from initially.

Mike

---

From: Mark Baugher <[email-masked]>
Date: Thu, 18 Sep 2014 15:46:44 -0700

The retail model works here.  I can imagine a compliant CPE might allow the use to "take ownership" of an interior HNCP interface.  That's only if the provider of that CPE wanted to be compliant to a future HNCP security standard.

Mark

---

From: Ted Lemon <[email-masked]>
Date: Fri, 19 Sep 2014 06:25:49 -0400

> The retail model works here.  I can imagine a compliant CPE might allow the use to "take ownership" of an interior HNCP interface. That's only if the provider of that CPE wanted to be compliant to…

So to be clear, we are now talking about setting up a system where, with HNCP, routers can be anointed by the manufacturer in a registry that ordinary folks wouldn't have access to.   To put it as mildly as possible, I do not support this suggestion: I want home routers to be under the control of the user, not the manufacturer.

---

From: Mark Baugher <[email-masked]>
Date: Fri, 19 Sep 2014 05:46:00 -0700

On Sep 19, 2014, at 3:25 AM, Ted Lemon <[email-masked]> wrote:

> So to be clear, we are now talking about setting up a system where, with HNCP, routers can be anointed by the manufacturer in a registry that ordinary folks wouldn't have access to.  

No, that's the exact opposite of what I think.  It's what I meant to write as "...allow the use[r] to take ownership of the interior HNCP interface.

> To put it as mildly as possible, I do not support this suggestion: I want home routers to be under the control of the user, not the manufacturer.

How could it be otherwise?  If you have two service providers in a household, how would one take authority over the other?  And what does the manufacturer have to do with it?  There might be a device from a third or a other provider/authority in the household.  For that reason, it is not realistic to define layer 4 or layer 3 security bindings and then "punt" on authorization.  Unlike enterprise or public networks, there is no single authority with an IT department to insert pre-shared keys in the devices or set up a CA. 

My suggestion is to start with authorization, because there are potentially multiple owners of the routers, and there needs to be some means for the owner/user of the network to "Take Ownership," which is a term used by Walker and Ellison in their home network security work.  This has all be designed and implemented before.

Mark

---

From: Michael Richardson <[email-masked]>
Date: Tue, 23 Sep 2014 13:59:17 -0400

> relationships would hinge on the answer

1) if there only one home router from the ISP, then there is no problem.
2) ISP-provided router has to be willing to trust retail purchased router,
   or nothing works.
3) ISP-A-provided router has to be willing to trust ISP-fullfilled router
   from ISP-B-provided router.

If you have secrets (including WPA-PSK keys) that are on your ISP-fullfilled
router, that you want to keep secret from your ISP, then you lost.
If you don't trust your ISP, then you can't use your ISP provided router.

So the answer does *not* hinge on the answer.
It has to work, and I think we can make it work.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Thomas <[email-masked]>
Date: Tue, 23 Sep 2014 11:32:20 -0700

> 2) ISP-provided router has to be willing to trust retail purchased router,

So what about the other way around? To what degrees should my homenet trust
ISP-maintained CPE?

Or more succinctly, what are the things the ISP and Retail CPE need to 
collaborate on
and what are the things they need to take an adversarial stance on? 
Neither me, nor
my ISP are similarly motivated, after all.

Mike

---

From: Michael Richardson <[email-masked]>
Date: Tue, 23 Sep 2014 16:07:13 -0400

> So what about the other way around? To what degrees should my homenet trust

That's up to you.  Seriously.
Your ISP-maintained CPE totally p0wns your network.  If you don't trust them,
even just a little bit, then you can't use their equipment.

---

From: Michael Thomas <[email-masked]>
Date: Tue, 23 Sep 2014 15:39:00 -0700

> even just a little bit, then you can't use their equipment.

And there's nothing we can do about that, even if we define a boundary
such that they are outside it?

Do they *have* to participate in the IGP in order for homenet routing to 
work?

I'm no expert here, but it seems to me that the normal first hop ISP 
router doesn't
have these characteristics of p0nwage for in-home traffic?

Mike

---

From: Douglas Otis <[email-masked]>
Date: Tue, 23 Sep 2014 16:57:46 -0700

On Sep 23, 2014, at 3:39 PM, Michael Thomas <[email-masked]> wrote:

> Do they *have* to participate in the IGP in order for homenet routing to work?
> 
> I'm no expert here, but it seems to me that the normal first hop ISP router doesn't

Dear Michael,

Actually, it is better to assume there is a long list of vulnerable home routers being p0wned by entities beyond their ISP.   Leaving that problem aside and assuming this can be handled using a KISS approach, even setting up firewalls when their are multiple routers involved becomes somewhat problematic whenever overlaid networking is not being used.  After all, how can each router's assigned prefixes be exchanged.  How can mDNS proxy information be communicated?  It is important to consider many of the contained devices might be vulnerable to Internet access.  Not all devices are updated beyond their warranty period.  In some cases, this period might be a 20/20 guarantee, 20 feet or 20 seconds, whichever comes first.  While some printers might be able to handle direct Internet access, most can't.  Many of these devices announce their routable address via mDNS, hence the need for a network overlay.  By using a network overlay, Trust on First Use (TOFU) is less essential although nice to have as an additional layer of protection.

Regards,
Douglas Otis

---

From: Ted Lemon <[email-masked]>
Date: Tue, 23 Sep 2014 21:15:09 -0400

On Sep 23, 2014, at 7:57 PM, Douglas Otis <[email-masked]> wrote:
> Actually, it is better to assume there is a long list of vulnerable home routers being p0wned by entities beyond their ISP.

This is to some extent true, but not something we can really address in homenet.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 24 Sep 2014 10:46:37 -0400

> such that they are outside it?

You can run another router inside, and if the ISP router supports being a
DHCPv6-PD (such as proposed by HIP), you might win.  Otherwise, you might as
well stick with IPv4+NAT, I think (maybe with v6 in a tunnel).

Me, I just buy by own router + modem, and I can't get a modem, many ISPs
understand when you want to turn their router into a modem only.

    > have these characteristics of p0nwage for in-home traffic?

Right now, with IPv4 only, the ISP provided router (which usually includes
wifi) completely p0wns the house.  I believe that when you get DSL from
free.fr, that they actually put up another ESSID which accepts VoIP traffic
From their mobile phone subscribers.  That's why free.fr is so inexpensive;
the DSL subscribers provide the mobile phone infrastructure.

(free.fr is open about this.  I've long suspected Bell Canada wants to do the
same thing, and I observe them essentially squatting on wifi channels all
over the place)

---

From: Michael Thomas <[email-masked]>
Date: Wed, 24 Sep 2014 12:06:15 -0700

> the DSL subscribers provide the mobile phone infrastructure.

Sorry, I was talking about the upstream aggregation router, not the 
in-home router.
That is, if I treat the ISP CPE the same way that I treat my ISP's 
aggregation router,
I can define it as being "outside". That, of course, as you note above 
means that you
can't use their wireless etc lest you open yourself to be p0wned by them.

As far as DHCPv6 PD, can you just convince their CPE to bridge and let 
the aggregation
router do it, or perhaps just set up their CPE as a DHCP relay, or maybe 
something else?
As I say I'm not an expert here so sorry if these are dumb questions.

Mike

---

From: Michael Richardson <[email-masked]>
Date: Thu, 25 Sep 2014 19:58:29 -0400

Michael Thomas <[email-masked]> wrote:
    >> So what about the other way around? To what degrees should my
    >> homenet trust ISP-maintained CPE?

    > in-home router.  That is, if I treat the ISP CPE the same way that I
    > treat my ISP's aggregation router, I can define it as being
    > "outside". That, of course, as you note above means that you can't use
    > their wireless etc lest you open yourself to be p0wned by them.

If you are asking if I have to trust the ISP upstream aggregation router
(so s/CPE/router/ in >> above), then answer is that router is not involved
at all in the homenet's security perimeter.