Subject: [saag] OS OR SA, not OS XOR SA (Re: opportunistic security again)

From: Nico Williams <[email-masked]>
Date: Mon, 7 Jul 2014 00:53:47 -0500

On Wed, Jul 2, 2014 at 5:32 PM, Stephen Farrell
<[email-masked]> wrote:
> On 02/07/14 23:28, Michael Richardson wrote:
>> then it is no longer opportunistic;
>
> That "it" is ambiguous. The putative protocol in question
> still does support OS, but in that particular run of that
> deployment, it may be authenticating one or more endpoints.

I'm unwilling to say: OS XOR SA (SA==strong authentication), not
without a fair bit more discussion.

To get OS OR SA requires some UI element (see other recent response of mine).

There may be cases where no UI element may be had, not even future
failure on downgrade.  In such cases we can only have OS XOR SA.  Are
there realistic OS XOR SA cases?

End-to-end IPsec is not a good example case, FYI, because there's
generally no good UI other than rummaging through logs to find out why
bits aren't moving.  Of course, IPsec could have better interfaces,
but no standard interfaces exist other than the configuration
databases like the PAD and SPD.  I.e., end-to-end IPsec can't really
provide SA as it is.

Nico
--

---

From: Paul Wouters <[email-masked]>
Date: Mon, 07 Jul 2014 10:08:39 -0400

On 07/07/2014 01:53 AM, Nico Williams wrote:

 I.e., end-to-end IPsec can't really
> provide SA as it is.

It's not that hard to write a dbus or networkmanager notification. The UI part here is not a problem

Paul

---

From: Nico Williams <[email-masked]>
Date: Mon, 7 Jul 2014 10:14:33 -0500

> It's not that hard to write a dbus or networkmanager notification. The UI part here is not a problem

That's not responsive to my claim that whether we get OS OR SA or OS
XOR SA is UI dependent.

Nor is your reply all that useful as to IPsec.  IPsec end-to-end
errors should be part of the socket API., and hell, end-to-end IPsec
needs to be part of the socket API altogether (see Solaris/Illumos'
IP_SEC_OPT socket option, see RFC 5660, and the charter of the now
concluded BTNS WG).  The non-existence of the dbus/networkmanager
notification you mention is telling :/  All these missing APIs and UIs
are a large part of why end-to-end IPsec is not used much and not
scalable to Internet scale.

BTW, if we continue the IPsec-specific sub-thread let's change the
Subject: again.  This thread should be for discussion of its current
Subject:.

Nico
--