Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 14 Aug 2019 09:52:00 +0200
From:   =?utf-8?Q?Micha=C5=82?= Lowas-Rzechonek 
        <michal.lowas-rzechonek@silvair.com>
To:     Brian Gix <brian.gix@intel.com>
Cc:     linux-bluetooth@vger.kernel.org, marcel@holtmann.org,
        johan.hedberg@gmail.com, inga.stotland@intel.com
Subject: Re: [PATCH BlueZ 0/1] mesh: Add D-Bus Security for sensitive data
Message-ID: <20190814075200.j3jmxpto7kszjjkp@mlowasrzechonek2133>
Mail-Followup-To: Brian Gix <brian.gix@intel.com>,
        linux-bluetooth@vger.kernel.org, marcel@holtmann.org,
        johan.hedberg@gmail.com, inga.stotland@intel.com
References: <20190814014357.32453-1-brian.gix@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20190814014357.32453-1-brian.gix@intel.com>
User-Agent: NeoMutt/20180716
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Brian,

On 08/13, Brian Gix wrote:
> There are various "security sensitive" pieces of data that need to be
> exchanged between Applications and the Bluetooth Mesh daemon.
> 
> The following items will be encrypted before sending over D-Bus:
> 
> token --  This is used by all nodes.
> 
> net_keys, app_keys, dev_keys -- These will only typically be needed by
> Provisioner/Config Client nodes to extract the keys for purposes of
> Cponfiguration Database transfer.
Please don't.

I don't see any benefit from doing so. D-Bus traffic cannot be sniffed
by an unprivileged user, and privileged user already has access to the
storage and can extract all this information from there.

In my opinion there is little point in encrypting D-Bus traffic. Noone
else does that:

 - ConnMan sends login/password pairs over D-Bus in
   https://git.kernel.org/pub/scm/network/connman/connman.git/tree/doc/vpn-agent-api.txt
 - BlueZ sends pairing secrets in
   https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/doc/agent-api.txt

regards
-- 
Michał Lowas-Rzechonek <michal.lowas-rzechonek@silvair.com>
Silvair http://silvair.com
Jasnogórska 44, 31-358 Krakow, POLAND