Subject: [MSEC] [Fwd: MSEC review of 802.16e MBS security]

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 02 Jun 2005 14:08:01 -0400

Hi all,

This is in response to a formal request for review from the 802.16 
group.  I am cc'ing the IETF liaison (Bernard Aboba) and the AD so they 
are aware of our efforts.  Jeff Mandin is the 802.16 liaison to the 
IETF.  The liaison letters are available from below:

http://ieee802.org/16/liaison/docs/L80216-05_025.pdf
http://ieee802.org/16/liaison/docs/L80216-05_039.pdf

We need a few volunteers to review a few sections (related to multicast 
and broadcast security) in the 802.16e specification, and prepare what 
amounts to a security considerations (identify any vulnerabilities in 
the 16e specification and suggest mitigation techniques or strategies) 
document.

I know a bit about the 802.16 specification, and speaking from 
experience, it should not take more than a few hours of your time given 
this group's knowledge in multicast and group security protocols.

Please volunteer and read Jeff's proposed outline below.  If you are 
interested, please send Ran and I an email.  Thanks in advance.

best regards,
Lakshminath

-------- Original Message --------
Subject: 	MSEC review of 802.16e MBS security
Date: 	Wed, 1 Jun 2005 12:38:59 +0200
From: 	Jeff Mandin <[email-masked]>
Reply-To: 	[email-masked]
To: 	[email-masked]

Lakshminath hi,

Hope things are going well at Qualcomm.  Now that the EAP WG's review
is in full swing, I'd like to move ahead with the MSEC review
discussed before.

The material to be reviewed would be section 7.8.3 of 802.16e draft
D8, and any additional sections that are perceived by the reviewers as
relevant (ie. 7.8.4.1 AES-CTR and 7.2.2.2 key derivation).  The
purpose of the review would of course be to note any security issues
and assist 16e in resolving them.

The EAP review is probably a good model for how this can work:

  - 2-3 people from MSEC would be the formal reviewers

  - a mailing list would be set up and include the reviewers, 1-3
people from 802.16 (probably me and 1-2 of the people behind MBS), and
perhaps other specific people from MSEC if there is interest.  Initial
reflector discussions (and hopefully telecons) would focus on
understanding what's actually in the 802.16 spec.

  -  MSEC would then prepare an initial review document outlining any
issues and make it available to a broader group of .16 members for
response and discussion of solutions.

 - .16e would then propose changes at the next recirc, and MSEC would
send a formal liaison letter to 802.16 in advance of the 7/17 San
Francisco 802 meeting.

How does this sound?  If it's feasible, then we can put together a
specific timeline for the next 6 weeks.

BRs,

- Jeff

_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 14 Jun 2005 17:24:18 -0400

Hi folks,

I have heard back from one person about this, but no one has signed up 
for this work yet.  So, here is my pitch again, especially to grad 
students on the list.

As you might recall/know, an analysis on the 802.11i 4-way exchange was 
accepted for publication/presentation at this year's (or last year's) 
NDSS conference.  This may be your chance to read the 802.16e 
specification (the draft specification is not publicly available), 
analyze it so the 16e group can improve it and so forth, and for you to 
perhaps get a publication out of it.  You might also get to know other 
MSEC contributors along the way so you can network etc. 

**So, please sign up!!**   Thanks in advance.

best regards,
Lakshminath

Lakshminath Dondeti wrote:

> group.  I am cc'ing the IETF liaison (Bernard Aboba) and the AD so 
> they are aware of our efforts.  Jeff Mandin is the 802.16 liaison to 
> the IETF.  The liaison letters are available from below:
>
> We need a few volunteers to review a few sections (related to 
> multicast and broadcast security) in the 802.16e specification, and 
> prepare what amounts to a security considerations (identify any 
> vulnerabilities in the 16e specification and suggest mitigation 
> techniques or strategies) document.
>
> experience, it should not take more than a few hours of your time 
> given this group's knowledge in multicast and group security protocols.
>