Subject: Re: [homenet] [babel] Éric Vyncke's Discuss on draft-ietf-babel-applicability-07: (with DISCUSS and COMMENT)

From: "STARK, BARBARA H" <[email-masked]>
Date: Tue, 6 Aug 2019 18:13:25 +0000

Removing unnecessary participants from the discussion (I don't think its relevant to the IESG review of babel-applicability?), and adding homenet...

> > How does the HOMENET usage of babel fit into this?  I would be
> > surprised if they were expecting secure link layers to be used inside
> > the home, but it does seem like the threat model for HOMENET includes
> > hostile or compromised devices in the home.
> 
> Barbara will correct me if I'm wrong, but as far as I know, the Homenet
> working group hasn't decided on a security mechanism yet.  I have heard
> opinions to the effect that Homenet requires asymmetric authentication, in
> which case Babel-DTLS would be necessary, but I wouldn't presume to judge
> whether these opinions represent WG consensus.

Homenet WG hasn't documented its security requirements -- for anything.
The current model for securing home networks is to secure the physical layers. 
The normal practice for dealing with compromised devices in the home is to remove or fix them when someone figures out they're compromised.
My personal (individual) opinion is it's extremely important to have tools to discover when a device is causing trouble. On-going protection against such devices (so they can be safely(?) left on the home network indefinitely and people can feel secure????) isn't important or even necessarily a good idea.

Babel-HMAC could identify anything trying to talk Babel without a key. If the compromised device has been given the keys (because the user thought it could be trusted and didn't know it was compromised), then neither HMAC nor DTLS will be of any protection.

---

From: Michael Thomas <[email-masked]>
Date: Thu, 8 Aug 2019 11:28:25 -0700

> My personal (individual) opinion is it's extremely important to have tools to discover when a device is causing trouble. On-going protection against such devices (so they can be safely(?) left on t…

Not only is this a security problem, it's a huge operational problem. 
Just a couple of weeks ago I spent an hour or two trying to track down 
why my internet connection was so slow. The tools to do this in my off 
the shelf buffer-bloated netgear router are non-existent. Yes, yes, I do 
know better but like almost everybody else I'm lazy and if ain't broken 
don't fix it... The advantage I have is that I at least have the ability 
to track it down, lousy tools or not. Other people, not so much.

As our home networks grow this is going to become more and more 
problematic. Like the time a roku box kept deciding to I wanted to watch 
tv in a room I wasn't even in over and over. Or when the crappy Hulu web 
interface keeps running even after I tell it to stop -- deleting the tab 
is the most effective, I've found.

I know that we have most if not all of the tools to address these sorts 
of problems, but I'm pretty sure my crappy Netgear router is pretty much 
par for the course. I'm sure that openWRT has a lot of tools to address 
this too, but openWRT seems pretty wonky to me (feel free to flame me if 
I'm wrong).

What I really want is somewhere, somehow, a 
what-the-hell-is-going-on-here app that can hunt down and deal with 
rogue devices and general network health.

Oh, it was a friend downloading a game.

Mike

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 8 Aug 2019 15:37:01 -0500

> Babel-HMAC could identify anything trying to talk Babel without a key. If the compromised device has been given the keys (because the user thought it could be trusted and didn't know it was comprom…

Hmm, so do you think it's possible that HOMENET could land in the "uses
secure link layers" bucket?  (It sounds like it's also possible it would
use babel-hmac or babel-dtls.)  I can readjust my expectations accordingly...

Thanks,

Ben

---

From: Juliusz Chroboczek <[email-masked]>
Date: Thu, 08 Aug 2019 23:49:53 +0200

> secure link layers" bucket?

No opinion on the above.  I'll only state that HNCP supports running over
DTLS (this is implemented in hnetd, the reference implementation of HNCP).
Section 8.3 of RFC 7787 describes a distributed algorithm for
semi-autonomously choosing a set of trusted DTLS keys.

> (It sounds like it's also possibl e it would use babel-hmac or babel-dtls.)

If Homenet ends up running HNCP in a secure mode, then it could be used as
a trust anchor for Babel.  We could do either of the following:

  - use HNCP to elect a single Babel-HMAC key for the network;
  - generate random Babel-DTLS keypairs and flood the public part
    over HNCP;
  - reuse HNCP keypairs in Babel-DTLS.

Of course, if HNCP runs insecure, then it would be somewhat doubtful to
use it for key distribution.

-- Juliusz