Subject: [saag] feedback on draft-aura-eap-noob-00

From: Andrei Gurtov <[email-masked]>
Date: Fri, 19 Feb 2016 15:48:32 +0200

Hi,

I read the new draft draft-aura-eap-noob-00.txt and just want to
provide some comments on it.

I think the draft is quite useful as it provides an opportunity to
enroll new devices to network which has only limited communication
capabilities (e.g. a public display).

The draft is very readable and almost complete, i didn't find any
typos or obvious omissions in it. The NOOB name is kind of funny, but
I guess authors chose it intentionally.

About the protocol, I'm wondering if explicit OOB authentication is
needed if during DH it's possible to transmit one of the messages on
the other channel or spread the messages using coding over multiple
channels. See e.g.
http://link.springer.com/chapter/10.1007%2F978-3-642-41717-7_24

In Security claims sec 5.4 there is no mentioning of DoS attacks. Is
the protocol vulnerable to those? Is there a need to employ a puzzle
mechanism, for example?

BR
Andrei
- -- 
Andrei Gurtov, PhD, ACM Distinguished Scientist
IEEE ComSoc Distinguished Lecturer & Vice-chair, IEEE Finland
Principal Scientist, Helsinki Institute for Information Technology HIIT
Adjunct Professor Aalto University, University of Oulu and University
of Helsinki
http://www.hiit.fi/~gurtov
https://www.researchgate.net/profile/Andrei_Gurtov

---

From: Mohit Sethi <[email-masked]>
Date: Mon, 29 Feb 2016 19:06:36 +0200

Hi Andrei

Thank you for your feedback.

I read the paper that suggests spraying the messages over multiple paths 
between the sender an receiver in a MANET. However, the scheme presented 
there relies on the special network topology and the assumption that 
there are several independent paths between the sender and the receiver. 
However, in typical 802.1x port-based authentication scenario, there is 
only one path between the peer and server. Therefore we require the OOB 
step.

While a puzzle mechanism might be suitable in some scenarios, battery 
operated IoT devices are at a disadvantage compared to the potential 
attacker in solving computational puzzles. However, we will add a 
section on DoS attack considerations in the next revision.

/--Mohit

On 02/19/2016 03:48 PM, Andrei Gurtov wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iEYEARECAAYFAlbHHTAACgkQP7jp0uceFkSdfQCdFiX5EvvpmgDRA1x4qn6h3fxm
> KXIAoI+uCh5km2sqAFe+D7ovCg06Uez2
> =rOEB
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag