Subject: Re: zeroconf security - conclusions

From: Stuart Cheshire <[email-masked]>
Date: Tue, 9 May 2000 14:28:48 -0700

>I.e., "zeroconf" in this case would apply only to the device's
>ability to announce itself to the rest of the network after
>initially being turned on, and start up in "Here I am, but
>now I need to be configured" mode.

This is a good point.

I think one of the big uses of zeroconf is bootstrapping.

My little 3COM router at home has physical security -- it is configured 
using a VT100 terminal plugged into its serial port. This is slow and 
clumsy and the serial port adds hardware cost to the device.

My AirPort base station at home doesn't have a serial port. It is 
configured in the obvious sensible way -- using SNMP packets, over IP 
over wired (or wireless) Ethernet. Of course the first thing I did was 
configure a password to protect it. How did I communicate with it to set 
the password in the first place? Via zeroconf IP. If the thing had not 
arrived speaking IP out-of-the-box, then I would have needed some other 
way to communicate with it to set the password -- like the serial port on 
the 3COM router.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer

---

From: Aidan Williams <[email-masked]>
Date: Wed, 10 May 2000 16:55:12 +1000

> way to communicate with it to set the password -- like the serial port on

I take your point that it is better not to need an out-of-band
configuration mechanism (like a terminal+cable).

However, it still seems to be the case that someone with a
wavelan card can see all your packets, and can therefore grab
your SNMP community string, and can therefore reconfigure your
gateway (assuming of course that you have reason to talk to the
thing after you set it up).

Doing the setup over a wire gives you physical security as
you allude to.  Doing it over wireless reduces or removes
that security.

Do you use L2 encryption?  If so, how was that configured?

regards
	aidan
____
:wq!

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 24 May 2000 22:25:50 -0700

>way to communicate with it to set the password -- like the serial port on 

Had this been a wired link, I'd agree that this would be sensible. But
given that the above procedure transfers a key over an unencrypted
broadcast media, I'd argue for a more secure key management technique.