Subject: [ieee-ietf-coord] FW: IEEE 802 November Plenary - New Study Groups

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 16 Dec 2013 15:39:59 +0000

From: new-work [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, December 16, 2013 5:37 PM
To: [email-masked]
Cc: [email-masked]
Subject: [new-work] IEEE 802 November Plenary - New Study Groups

Dear Members of the IETF,

In the spirit of continuing cooperation between IEEE 802 and IETF, the following letter addresses new work items for information and potential coordination with the respective IEEE 802 WG.

One of the first steps in the IEEE Standards Association's standards development process is the creation of a Study Group. Study groups are chartered to create a formal Project Authorization Request (PAR) document that includes a description of the project's scope and purpose.

The following Study Groups were approved at the Nov 2013 IEEE 802 Plenary -

*         IEEE 802.22 Spectrum Occupancy Sensing (SOS) Study Group

*         IEEE 802.15.7 Optical Camera Communications Study Group

*         IEEE 802.15.4 Common Ranging Protocol Study Group

*         IEEE 802.15.4 EU Regional PHY Support Study Group

Further information about these Study Groups may be found at http://www.ieee802.org/StudyGroups.shtml.

Please note, per the IEEE 802 Policies and Procedures that a Study Group is chartered to operate from plenary session-to-plenary session, a period of four months and, if it wishes to continue, must request a charter extension. Therefore, the Study Groups, listed above are chartered until the IEEE 802 November 2013 Plenary Session. Study Groups may also terminate between plenary sessions if their proposed project is approved by the IEEE Standards Association Standards Board.

Additionally, within the IEEE 802 family of standards, there is a requirement that each new project proposal attaches additional documentation that describes its engineering feasibility, market potential, assurance of coexistence and distinct identity relative to previous standards (referred to as the "five criteria" in 802). The "five criteria" used by IEEE 802 can be found in document:

https://mentor.ieee.org/802-ec/dcn/13/ec-13-0002-01-00EC-five-criteria-om-extract-informative.doc

Also please note that IEEE meetings are open and may be attended by any individuals who register and fulfill any registration fees. Details regarding future IEEE 802 plenary meeting schedules may be found at http://802world.org/plenary/future-plenary-sessions/.   Please refer to individual working groups for their interim meeting schedules. A listing of all working groups may be found at http://www.ieee802.org/.

Sincerely,

John D'Ambrosia

Recording Secretary, IEEE 802 LMSC

[email-masked]<mailto:[email-masked]>

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 16 Dec 2013 15:58:46 +0000

Hi Dan,

An IETF last-call comment on draft-farrell-perpass-attack [1]
quite properly pointed out that the IETF doesn't control all
protocols that may be related to pervasive monitoring. If the
IEEE were considering this problem and/or doing something about
it, that'd be a fine thing to know about. I'm sure if there
is related activity in IEEE that'd definitely be of interest
to IETF folks thinking about the problem.

Can we ask that question sometime in a way that'd be useful?

It would probably make more sense to wait until the IETF has or
has not approved this draft though before asking formally or
near-formally, so in the meantime this is just an individual
heads-up that the question might come up in the new year.

Cheers,
S.

PS: I'm cc'ing the list of folks to whom you sent the
most recent new-work message, plus Steve Kent who made the
comment. But I don't expect responses now, better to wait
until the IETF LC for the document is done.

[1] https://tools.ietf.org/html/draft-farrell-perpass-attack

---

From: Pat Thaler <[email-masked]>
Date: Tue, 17 Dec 2013 00:42:14 +0000

Hi Stephen, 

I'm not seeing where in draft-farrell-perpass-attack that it points that out (and it's a fairly short document). 

IEEE 802.1 has a security task group. I've copied Mick Seaman, the chair of that group. There are standards in IEEE 802 that may play a part in mitigation.
IEEE 802.1AE covers MAC Sec which provides encryption at layer 2.
IEEE 802.1X covers authentication and key exchange.
IEEE 802.1AR covers Secure Device Identity. 

Recent work has been to add an AES-256 cipher suite to IEEE 802.1AE and adjustments to IEEE 802.1AE and 802.1X (the latter still in progress) to deal with link speeds over 100 Gb/s. There are some additional projects being considered: an amendment to IEEE 802.1AR to add options with more cryptographic strength: SHA-384 and P-384 Elliptic Curve; and an amendment to IEEE 802.1AE to define Ethernet Data Encryptors - see: http://www.ieee802.org/1/files/public/docs2013/ae-seaman-ede-0713-v02.pdf

The IEEE 802 wireless standards often have additional security provisions.

Regards,
Pat

-----Original Message-----
From: ieee-ietf-coord [mailto:[email-masked]] On Behalf Of Stephen Farrell
Sent: Monday, December 16, 2013 7:59 AM
To: Romascanu, Dan (Dan)
Cc: [email-masked]; Stephen Kent; [email-masked]; The IESG; [email-masked]
Subject: [ieee-ietf-coord] possible future question to IEEE folks

Hi Dan,

Cheers,
S.

[1] https://tools.ietf.org/html/draft-farrell-perpass-attack
_______________________________________________
ieee-ietf-coord mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ieee-ietf-coord

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 17 Dec 2013 00:49:27 +0000

Hi Pat,

On 12/17/2013 12:42 AM, Pat Thaler wrote:
> Hi Stephen,
> 
> I'm not seeing where in draft-farrell-perpass-attack that it points
> that out (and it's a fairly short document).

Ah no - the draft is just an IETF thing, the comment about IEEE
was raised as part of the IETF LC. We'd not include text about
what you folks do in an IETF BCP, at least not without talking
first. But, if this draft is approved, then it'll be useful for
some WGs who are figuring out what it means for their work to
know more about what IEEE protocols can offer but also e.g.
whether mitigations addressing say meta-data at the IP layer
might not be as valuable if/when layer 2 could give the game
away.

Anyway, thanks for the info below and will follow up when/if
this draft is approved. (But of course happy to chat in the
meantime if it helps.)

Cheers,
S.

> IEEE 802.1 has a security task group. I've copied Mick Seaman, the
> chair of that group. There are standards in IEEE 802 that may play a
> part in mitigation. IEEE 802.1AE covers MAC Sec which provides
> encryption at layer 2. IEEE 802.1X covers authentication and key
> exchange. IEEE 802.1AR covers Secure Device Identity.
> 
> Recent work has been to add an AES-256 cipher suite to IEEE 802.1AE
> and adjustments to IEEE 802.1AE and 802.1X (the latter still in
> progress) to deal with link speeds over 100 Gb/s. There are some
> additional projects being considered: an amendment to IEEE 802.1AR to
> add options with more cryptographic strength: SHA-384 and P-384
> Elliptic Curve; and an amendment to IEEE 802.1AE to define Ethernet
> Data Encryptors - see:
> http://www.ieee802.org/1/files/public/docs2013/ae-seaman-ede-0713-v02.pdf
>
> Regards, Pat
> -----Original Message----- From: ieee-ietf-coord
> [mailto:[email-masked]] On Behalf Of Stephen
> Farrell Sent: Monday, December 16, 2013 7:59 AM To: Romascanu, Dan
> (Dan) Cc: [email-masked]; Stephen Kent; [email-masked]; The IESG;
> [email-masked] Subject: [ieee-ietf-coord] possible future
> question to IEEE folks
> 
> 
> Hi Dan,
> 
> An IETF last-call comment on draft-farrell-perpass-attack [1] quite
> properly pointed out that the IETF doesn't control all protocols that
> may be related to pervasive monitoring. If the IEEE were considering
> this problem and/or doing something about it, that'd be a fine thing
> to know about. I'm sure if there is related activity in IEEE that'd
> definitely be of interest to IETF folks thinking about the problem.
> 
> It would probably make more sense to wait until the IETF has or has
> not approved this draft though before asking formally or 
> near-formally, so in the meantime this is just an individual heads-up
> that the question might come up in the new year.
> 
> Cheers, S.
> 
> PS: I'm cc'ing the list of folks to whom you sent the most recent
> new-work message, plus Steve Kent who made the comment. But I don't
> expect responses now, better to wait until the IETF LC for the
> document is done.
> 
> _______________________________________________ ieee-ietf-coord
> mailing list [email-masked]

---

From: <[email-masked]>
Date: Mon, 16 Dec 2013 18:13:09 +0000

IEEE-SA has sponsored development of cryptographic algorithm standards in the past, so perhaps one question to ask them is whether they are looking at expanding that effort. 

With respect to link layer protocols, there is IEEE 802.1X, which in the 2010 revision enables per-frame encryption, authentication and integrity protection for wired networks;  IEEE 802.11 security, which is based on IEEE 802.1X-2004; and security in IEEE 802.16 which is based on EAP.   One question to pose with respect to those protocols is to ask about plans to support algorithm agility. 

From: Stephen Farrell
Sent: ‎Monday‎, ‎December‎ ‎16‎, ‎2013 ‎10‎:‎58‎ ‎AM
To: [email-masked]
Cc: [email-masked], Stephen Kent, [email-masked], [email-masked], [email-masked]

Hi Dan,

Cheers,
S.