Thread Links Date Links
Thread Prev Thread Next Thread Index Date Prev Date Next Date Index

Re: [STDS-802-Privacy] Proposal on a MAC mediator protocol



Title: Standard

On 11/06/2014 07:49 PM, Dan Harkins wrote:

  Hi Bob,

  I hate to be a wet blanket, but…

  Why bother with security in this exchange? The association is unsecured (assuming
that management frame protection is not enabled because if it is then the STA has
already committed to the ESS with a particular MAC address) so what's the point
of having a secured address assignment protocol? Any attacker that could muck
with the unsecured address assignment protocol can muck with the unsecured
association.

So .11 implements this within the BEACON/ASSOCIATION process.  If the AP is not the DHCP server, for example, it proxies this back.  Details to follow,


  In general, I'm all in favor of securing everything. But there is cost associated with
this. Namely, distribution of the MAC mediator's public key. That should be secured
because otherwise, well the same guy that can muck with the address assignment
protocol (the reason you want to secure it) can muck with the announcements of
the MAC mediator's public key. And to secure this means there's some trust
anchor that the STA has. And now we've just embraced a tar baby.

I think even on a large, bridged ethernet, an mucker will be distinguished.  Plus it is just another DOS attack, blocking a system from communicating.  I have some thoughts on this, and will work it out.  Provided I am working on any of this come next year...


  This sounds like a huge undertaking and I'm just not seeing the benefit. What am
I missing?

Reasonable question.  Just if there is going to be a mediator protocol, it will just cause more problems if not secure.  I mean right now, DHCP could implement something without security, or can it?  If a second device requests a DHCP lease, will it get anything different than what is currently assigned to that MACaddr?

but is the end of the week and my head is hurting....


  regards,

  Dan.

On 11/5/14 11:30 PM, "Robert Moskowitz" <rgm@xxxxxxxxxxxxxxxxxxxx> wrote:

The following is a proposal on a MAC address mediator protocol.

Its purpose is to resolve MACaddr collisions, meeting the 802 policy
that if local scope addresses are used, there will be such a mediator
feature (or some such; someone help me with the exact wording that Pat
used monday evening).

To work, this protocol is crypographically based.  Paul Lambert had
point out to me how my own ideas in HIP could be used for MAC addresses
as well.  I have thought a lot about this and I will cut to the chase,
skipping over why I chose want is here.  I am willing to put together a
few slides for thursday evening.

Here goes:

Every participating device has a MAC entity Identity consisting of the
public key of a ECDH keypair.  A hash of this key into a 128 bit value
is the MAC entity Identifier, much like the HIT in HIP.  A hash with a
nonce will be used to create the actual MACaddr used by the device.  For
privacy purposes, the ECDH keypair are ephemeral, a device can
precompute a number of these and have them ready to use at will.  For
collision avoidance a device must be ready to use a different Identity
or nonce to present a different MACaddr.

The media MAC mediator will regularly broadcast its ECDH public key.  
This key MAY be contained within a digital certificate that a
participating device can validate from cached information; this is not
required.  The timing of these broadcasts will help a device to
recognize the mediator of the media.  In practice this could be a
function of a DHCP or RADVD server (or AP BEACON).

At linkup time, a device will listen for these broadcasts, use the
public key therein along with its Identity key and a nonce to construct
a shared secret.  This secret will be used to MIC a packet to the
mediator that will contain the devices:  MACaddr, Nonce, Identifier, and
Identity.  If this is a new MACaddr for the mediator it would reply with
an ACCEPT MICed message.  If there is a collision, it will REJECT,
causing the device to select a new MACaddr and try again.

The use of crypto should be apparent to most here, to protect against
attacks.  ECDH is the lightest weight algorithm we have.  I would even
recommend using a fold rather than a SHA hash as I do in HIP-DEX to
further lighten to load (for very small IoT devices, though 64 bit MACs
will should have a larger number space anyway). Plus the active nature
of an ECDH protocol protects against replay attacks.  A 'key' feature
here is that it is actually the Identifier (and Identity) that are
registered with the mediator, and thus presenting a much larger number
space to lower the probablity of collisions.

A 'downside' to the existance of such a mediator protocol is that it can
be argued that given a collision resolution protocol, the privacy
feature CAN operate within a smaller number space.

This mediator protocol would be optional in environments where ZEROconf
is used.  Afterall, who is the mediator on such a media?

This is basically a 3 packet protocol:  BEACON, REQUEST, RESPONSE. It
can be fit into many existing such protocols already deployed on various
media.

Thank you and goodnight.


--
Robert Moskowitz
Senior Technical Advisor
Security & Standards
Verizon Business Systems
C:      248-928-6233
F:      248-968-2824
E:      robert.moskowitz@xxxxxxxxxxx

There's no limit to what can be accomplished if it doesn't matter who gets the credit