Chapter 1: Product description
Wireless operation
Page 1-22
TLS RSA
Wireless Encryption TLS RSA can be used with the following Access Methods:
•
Link Access
•
Group Access
Access Method is automatically configured to Group Access in the HCMP topology.
Authentication using TLS RSA
TLS RSA uses the bidirectional exchange and verification of RSA device certificates to
determine the authentic identity of both ODUs. The ODU will not form a wireless link if the
encryption algorithm is TLS RSA and the certificate of the remote unit cannot be verified.
PTP 670 can be configured to use factory-installed device certificates, or user-supplied device
certificates. Both ends of the link must use the same certificate type.
User-supplied device certificates must be RSA certificates with key size of 2048 bits and SHA-
256, where the subject of the certificate is the MAC address of the ODU. For user-supplied
certificates, each ODU must be additionally configured with a self-signed Root CA certificate
that validates the device certificate of the remote ODU.
User-supplied device certificates are zeroized along with the other Critical Security Parameters
(CSPs). Factory-installed certificates are in permanent memory and are never zeroized.
Authorization using TLS RSA with Link Access
When PTP 670 is configured for Wireless Encryption of TLS RSA and Access Method of Link
Access, the ODU will not connect unless the authenticated MAC address of the remote ODU is
equal to the configured Target MAC Address attribute. The Target MAC Address authorizes the
remote ODU.
Authorization using TLS RSA with Group Access
When PTP 670 is configured for Wireless Encryption of TLS RSA and Access Method of Group
Access, two options are available for authorizing the remote ODU. With the Whitelist option,
the ODU will connect only if the authenticated MAC address of the remote unit has previously
been added to a list of authorized ODUs. With the Blacklist option, the ODU will always connect
unless the authenticated MAC address has previousy been added to a list of unauthorized
ODUs. The Whitelist and Blacklist cannot be used at the same time. The selection of Whitelist
and Blacklist is independent of the selection of Factory or User-provided certificates.
The default Blacklist/Factory combination offers limited benefits in a deployed network, since it
is impossible to add all PTP 670 ODUs with Factory certificates to the Blacklist. However, this
combination does provide a relatively simple way to build a network with the minimum of
configuration, in applications where security is not an immediate priority, for example when
evaluating wireless performance.
The Blacklist/User combination is attractive where links are to be established on an ad hoc
basis, as units pre-configured with the user-supplied certificate form a closed group that is
authomatically trusted, whilst only compromised units from the closed group need be added to
the Blacklist.
