RE: [LinkSec] LinkSec Security Issues & 802.10
Working on/correcting deficiencies in the 802.10 standards does not
necessarily mean that the 802.10 working group has to be resurrected to
do the work. There are several existing examples in 802 where 802.X has
raised PARs to contribute to/modify standards owned by 802.Y - the MAC
Bridge standards are prime examples where this has happened in the
past.
My primary concern is to ensure that the work doesn't get fragmented
across different working groups. This can work, but life will be much
simpler if the work is done in one place. Russ Housely has indicated to
me that the enhancements he considers necessary to the 802.10 standards
are relatively minor; given that, I would propose that it would be a much
more efficient solution for all concerned to make any changes to 802.10
under a PAR raised in 802.1, rather than resurrecting 802.10 and thereby
fragmenting the effort in 802.
Regards,
Tony
At 11:27 13/03/2003 -0800, Walker, Jesse wrote:
It
is my experience that any solution that meets ther requirements given the
study group will result in a solution very similar to IEEE 802.10, in
particular, the requirement of a security solution that applies across
802. This seems to speak to resurrecting 802.10 and correcting any
deficiencies in it.
-- Jesse Walker
From:
Ken Alonge <kennyg698@yahoo.com>
Subject: [LinkSec] LinkSec Security Issues & 802.10
To: stds-802-linksec@ieee.org
Sender: owner-stds-802-linksec@majordomo.ieee.org
X-Resent-To: Multiple Recipients
<stds-802-linksec@majordomo.ieee.org>
X-Info: [Un]Subscribe requests to
majordomo@majordomo.ieee.org
X-Moderator-Address:
stds-802-linksec-approval@majordomo.ieee.org
To All-
I'm having trouble sending e-mail
from my normal e-mail address, so I've had to resort to using this more
obscure address. Sorry.
After having participated in the
LinkSec meetings this week and having had discussions with many study
group participants as well as the Chairs of other MAC working groups, it
seems to me that the 802.10 Secure Data Exchange Protocol (SDE) is the
preferred method of providing generic security services across all of the
802 MACs (note that some MACs, like .11 would have additional security
within the MAC layer). In order to provide the all desired security
services, the SDE protocol will have to be slightly modified. The
modifications are needed in order to accommodate replay protection,
destination MAC address authentication, and optional integrity protection
of additional header fields such as the VLAN tag.
<?xml:namespace prefix = o ns =
"urn:schemas-microsoft-com:office:office"
/>
Another point of concern that was
raised in this week's LinkSec meeting was the ability of 802.1X to meet
the key management requirements of all the 802 MACs, because of the .1X
requirement to have access to a server for key distribution. This
type of configuration does not work for 802.15 where it is unreasonable
to expect an infrastructure; also it can cause denial of service in
enterprise networks when the authentication server cannot be reached. The
.1X protocol is great for the environments that it was designed to
support, but it does not fit all environments. Therefore, additional key
management approaches may be necessary.
Additionally, part of the LinkSec
charter is to develop an 802 security architecture document. 802.10
already published the 802 security architecture Standard. While we have
learned a lot since this document was developed, it does not make sense
to have two 802 Security Architectures. The current document (802.10a)
ought to be used as a baseline for the LinkSec security architecture
study. Revision of the .10 security architecture may be required to
accommodate information not considered when .10 originally created that
Standard.
These issues are being raised at a
good time, since all of the .10 Standards are up for reaffirmation this
year (i.e., 802.10-1998, 802.10a-1999, as well as 802.10c-1998 (the Key
Management standard)). So, in order to make the necessary
modifications, I am proposing that 802.10 be brought out of hibernation
by the Exec. I think that our initial focus should be on the SDE
revision; followed by needed modifications to, or withdrawal of the key
management standard, and; finally, possible modifications to the .10
security architecture Standard.
Two of the Exec members expressed to
me their concern that .10 might not have enough participants to do the
required revisions, and they would like me to demonstrate that an
unhibernated .10 will have sufficiently broad participation (membership),
drawing the necessary expertise from other working groups.
Therefore, I'm sending this e-mail to you to serve as a straw poll of the
LinkSec study group to determine who would be willing to participate in
an unhibernated .10 to assist in making the necessary revisions to our
Standards.
Your prompt response today would be
greatly appreciated.
Sincerely,
Ken Alonge
Chair, 802.10
Do you Yahoo!?
Yahoo! Web Hosting
- establish your business online
Regards,
Tony