1. Opportunistic Wireless Encryption
September 2015
doc.: IEEE /1128r0
September 2015
Opportunistic Wireless Encryption
Date:
Authors:
Dan Harkins, Aruba Networks (an HP company)
Dan Harkins, Aruba Networks (an HP company)

2. September 2015
doc.: IEEE /1128r0
September 2015
Abstract
This submission presents an idea for addressing a problem with public wi-fi hotspots
Dan Harkins, Aruba Networks (an HP company)
Dan Harkins, Aruba Networks (an HP company)

3. Coffee shop, bar, or restaurant wants to offer patrons “free wi-fi”
September 2015
doc.: IEEE /1128r0
September 2015
The Situation
Wireless Internet access as an entitlement– “oh, no wi-fi, let’s go somewhere else”
Coffee shop, bar, or restaurant wants to offer patrons “free wi-fi”
They want to provide a service but don’t want it to be a pain to configure or use
They want to provide some notion of both service and security to customers
Dan Harkins, Aruba Networks (an HP company)
Dan Harkins, Aruba Networks (an HP company)

4. The Problem Perpetual battle: Security vs Ease-of-Use
September 2015
doc.: IEEE /1128r0
September 2015
The Problem
Perpetual battle: Security vs Ease-of-Use
They want it to be easy-to-use
Don’t bug the staff too much– “no I said the L is capital”
Don’t irritate the customer– “wait, what? say that again”
Don’t require specialized knowledge– “what’s an EAP method? How do I configure an ‘anonymous identity’?”
They want some notion of security
Want it to be better-than-nothing security
Don’t want to have to get/generate/install a certificate
Secure access by patrons has to scale (see easy-to-use)
Result: Both sides lose
Dan Harkins, Aruba Networks (an HP company)
Dan Harkins, Aruba Networks (an HP company)

5. Dan Harkins, Aruba Networks (an HP company)
FAIL
September 2015
Dan Harkins, Aruba Networks (an HP company)

6. The Solution? OWE Make it simple to provision– just switch it on
September 2015
The Solution? OWE
Make it simple to provision– just switch it on
Make it virtually impossible to misconfigure– no user entry required
Make public wi-fi “suck less” than it does when using a shared PSK
Raise the bar that is necessary to perform pervasive monitoring just a bit higher
OWE is an outgrowth of an IETF BOF on improving the captive portal experience
Dan Harkins, Aruba Networks (an HP company)

7. IETF Proposal Upside Downside
September 2015
IETF Proposal
Network appears “open” to the user (no lock icon), uses a Vendor Specific Element in beacons and probe responses to indicate OWE
After association in an OWE network, STA and AP do the PSK authentication using the SSID as the password
Upside
No need to explain/enter anything, just works
Code changes AP side are trivial; STA side, manageable
Downside
Inherits all the security problems of shared PSK
Publicly advertises the PSK so arguably worse!
Dan Harkins, Aruba Networks (an HP company)

8. Don’t do it in the IETF, let’s do it here AP advertises an OWE AKM
September 2015
My Proposal
Don’t do it in the IETF, let’s do it here
AP advertises an OWE AKM
When associating to an SSID with OWE include Diffie-Hellman exponentials in (Re)Associate Request and Resonse
STA and AP perform Diffie-Hellman, use shared secret to derive a PMK
Use this (truly pairwise) PMK with 4-way HS
Dan Harkins, Aruba Networks (an HP company)

9. Benefits More secure than a shared PSK Easier to set-up than PSK
September 2015
Benefits
More secure than a shared PSK
Not susceptible to passive attack
All those tools downloadable from Internet to crack PSKs won’t work!
Easier to set-up than PSK
Nothing to provision or describe, no user error
Easier to use by customers
Absolutely nothing needed to do! It just works.
Makes pervasive monitoring harder
Easier to use plus better security! Winner, winner!
Dan Harkins, Aruba Networks (an HP company)

10. ขอขอบคณ ุ Thank You! September 2015
Dan Harkins, Aruba Networks (an HP company)

11. September 2015
Questions?
Dan Harkins, Aruba Networks (an HP company)

12. Option 1: Good idea, we should do it!
September 2015
OWE Straw Poll
Option 1: Good idea, we should do it!
Option 2: Bad idea, let the IETF do it!
Option 3: I was reading my and not paying attention, sorry.
Dan Harkins, Aruba Networks (an HP company)