Subject: RE: SEND with link-layer security

From: <[email-masked]>
Date: Wed, 26 Nov 2003 16:43:14 -0000

While reading and thinking about this thread, a question occurred to me.
Section 11.1 of draft-ietf-send-ndopt-00 states:

	For shared media, such as multiple nodes authenticated through 
	the same 802.11 AP (which acts as a single port for all nodes), 
	other measures [than 802.1x] are necessary [to prevent against 
	specific attacks]...

What 'other measures' are there, and would it be worth mentioning them
explicitly in this section of the document?

Mat

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Wed, 26 Nov 2003 09:48:05 -0800

> explicitly in this section of the document?

I'm wondering now whether we should take out this paragraph and the next,
and the last sentence in the previous paragraph. I don't believe the SEND
spec should be making specific recommendations about how people should
deploy 802.11 security. I think it should be sufficient to say what the
first paragraph says, namely that SEND does not protect against attacks at
the link layer - full stop - and leave it up to the link layer specification
to say how the link layer is secured and how to deploy that security.

We could add a sentence at the end of the first paragraph that says, in
effect, consult the link layer specification for information about how to
secure the link layer.

Comments?

            jak

---

From: Michael Richardson <[email-masked]>
Date: Sun, 30 Nov 2003 15:33:45 -0500

-----BEGIN PGP SIGNED MESSAGE-----

I believe that there are significant issues if we do not eventually work on
ways to bind link layer security (1x) and network layer security (SEND).

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------