Subject: Re: [manet] Alexey Melnikov's Discuss on draft-ietf-manet-dlep-26: (with DISCUSS and COMMENT)

From: "MATTY, Steven" <[email-masked]>
Date: Tue, 3 Jan 2017 15:03:53 +0000

On 15 Dec 2016, at 09:22, Henning Rogge <[email-masked]> wrote:

>On Thu, Dec 15, 2016 at 10:23 AM, Alexey Melnikov
><[email-masked]> wrote:
>
>>What kind of security does unauthenticated TLS provide against an
>>attacker that sits on your local LAN segment? Its not that DLEP carry
>>any "secret" data...
>
>I have spoken with a few radio vendors and from what I got none of
>them considers to implement TLS. Nobody sees any advantage of it, but
>everyone sees a huge cost. Cost in terms of performance (Flow control
>is delay dependent), cost in terms of complexity, costs in terms of
>interoperability.

FWIW, I can state with some certainty that the roadmap for our DLEP
implementation does NOT include support for TLS.

Steve
This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system. Airbus Defence and Space Limited disclaims any and all liability if this email transmission was virus corrupted, altered or falsified.
-o-
Emails to Airbus Defence and Space Limited may be processed, recorded and monitored outside the UK.
-o-
Airbus Defence and Space Limited, Registered in England and Wales No. 2449259
Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England

---

From: Stan Ratliff <[email-masked]>
Date: Mon, 30 Jan 2017 22:26:48 -0500

All,

The authors have submitted DLEP-27 to address the DISCUSS items. With
regard to Alexey's DISCUSS points,

On Thu, Dec 15, 2016 at 10:15 AM, Rick Taylor <rick@tropicalstormsoftware.
com> wrote:

> On Thu, 2016-12-15 at 14:58 +0000, Alexey Melnikov wrote:
> > On Thu, Dec 15, 2016, at 09:21 AM, Henning Rogge wrote:
> > >
> > > > Hi,
> > > > > On 15 Dec 2016, at 08:59, Henning Rogge <[email-masked]>
> > > > > wrote:
> > > > >
> > > > > On Tue, Dec 13, 2016 at 11:11 AM, Alexey Melnikov
> > > > > > Hi Stan,
> > > > > > All your answers look good to me. But I think credential
> > > > > > validation might need a bit more thought/discussion in the
> > > > > > WG. Maybe you can specify how preconfigured IP or MAC
> > > > > > addresses can be checked in X.509 certificates? (Just an
> > > > > > idea, not necessarily saying that it is the right or the only
> > > > > > way of doing this)
> > > > > I raised the point of the certificate problem ages ago as an
> > > > > argument
> > > > > to DROP TLS from DLEP completely.
> > > > Even unauthenticated TLS is better than no TLS, so I would rather
> > > > the document continues to recommend it.
> > > attacker that sits on your local LAN segment?
> > I am not really concerned about that, but I am concerned about VPN or
> > virtualized environment where router is across the globe from the
> > modem.
>

We have added an "Assumptions" section (Section 5), and have added text
(paragraph 2) stating that in a VPN environment between router and modem,
link statistics reported by DLEP may be inadequate for route selection.

We've also added text to the security considerations section concerning use
of pre-shared keys in mobile environments.

We hope this additional text addresses your concerns.

Regards,
Stan

>
> This was why we put in the text in the security considerations stating
> that those environments need all security provided by whatever Layer-2
> tunnelling protocols are used.  However, we had several discuss's
> suggesting that this wasn't enough...
>
> >
> > >
> > > Its not that DLEP carry
> > > any "secret" data...
> > That is the question really. If the date is exposed outside of LAN,
> > does
> > it contain no sensitive information?
> > > Henning Rogge
> > _______________________________________________
> > manet mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/manet
> _______________________________________________
> manet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manet
>