[LinkSec] issues/reqts
I've compiled some issues and reqts for discussion during the next
conference call. I tried to incorporate all comments in a coherent
fashion, taking the liberty to paraphrase in places. --Dennis
---- 802 LinkSec Issues and Requirements ----
Integrity of MAC CONTROL messages
Authenticated MAC-client mgmt/control
- e.g. RSTP
- MAC-client mgmt/control authentication code
- auth-code key establishment
- issue certificates for bridges?
+ no initialization stage for bridge LAN
+ authenticated discovery?
Controlled access of MAC-client data
- bridge port open/closed states
- protocol for setting port state
Authenticated MAC-client data
- 802.3 authentication code
- implies
+ strong access control
+ strong traffic separation
+ integrity
+ resistance to traffic mixing
- authentication must be efficient and scale to bridged LAN
- auth-code key establishment and distribution across bridges
- what is the authentication ID?
+ vlan id, STA-hwaddr, MILS-SAP ID, etc.?
+ conveyed across bridges?
+ choice impacts authentication scalability
- bridge can translate between unauthenticated and authenticated data
- efficient
Confidential MAC-client data
- does 802 have a privacy obligation?
+ broadcast/multicast frames
+ MAC-client mgmt/control
- privacy must be efficient and scale to bridged LAN
- key establishment and distribution across bridges
- what is the privacy ID?
+ vlan id, STA-hwaddr, MILS-SAP ID, etc.?
+ conveyed across bridges?
+ choice impacts privacy scalability
- bridge can translate between clear and encrypted data
- efficient
Protect against replay
- replay of what and where?
- scope of replay detection
+ across bridged LAN?
Be applicable to multiple 802 MAC protocols
- key management independent of MAC type
- should not require non802 protocols
Enrollment
- provide centralized management of device enrollment
- not limited to a single management system (e.g. multiple domains)
- provide means to identify management domain
- provide ability to 'disenroll' individual systems
- support strong authentication of devices based on enrollment
- provide ad-hoc enrollment (very debatable, e.g. 802.11 iBSS)
- no centralized enrollment server
- technically viable, many interesting use case scenarios,
likely could be split as a unique work item