Subject: [Emu] Appendices in draft-ietf-emu-chbind-11

From: Joe Salowey <[email-masked]>
Date: Wed, 14 Dec 2011 08:35:31 -0800

I think the following appendices of the channel binding document are no longer supported by the rest of the text and defined attributes.  I think they are out of date and should be removed:

A.3.  Downgrading attacks
A.4.  Bogus Beacons in IEEE 802.11r
A.5.  Forcing false authorization in IEEE 802.11i

Thanks,

Joe

---

From: Sam Hartman <[email-masked]>
Date: Wed, 14 Dec 2011 14:25:58 -0500

>>>>> "Joe" == Joe Salowey <[email-masked]> writes:

    Joe> I think the following appendices of the channel binding
    Joe> document are no longer supported by the rest of the text and
    Joe> defined attributes.  I think they are out of date and should be
    Joe> removed: A.3.  Downgrading attacks A.4.  Bogus Beacons in IEEE
    Joe> 802.11r A.5.  Forcing false authorization in IEEE 802.11i

I don't have an objection to removing these sections, although I
actually think the attacks described are still real attacks.  I think an
alternate solution would be to add a paragraph to the top of appendix A
pointing out that channel bindings are part of the solution.  To
actually prevent the attacks we'd need to define lower-layer documents
describing what attributes you bind and you'd need to deploy with the
appropriate configuration in the local database.  I.E. as far as this
document goes it does still support solving these attacks.  We just
reduced our scope to avoid the lower-layer specific issues, so more work
is needed.

I'd prefer to simply add a paragraph to the introduction of the appendix
 clearly explaining what additional work needs to happen.
However I'm happy removing if that's what the WG wants.

---

From: Joe Salowey <[email-masked]>
Date: Thu, 15 Dec 2011 11:21:10 -0800

I'm OK with the approach you propose. 

Joe