Subject: Re: [saag] [6lowpan] SOLACE things at SAAG

From: Carsten Bormann <[email-masked]>
Date: Mon, 29 Oct 2012 22:15:37 +0100

On Oct 29, 2012, at 21:45, Stephen Farrell <[email-masked]> wrote:

> If he and Cullen want to arm-wrestle
> that's fine:-)

Well, Cullen's I-D (please have a look at draft-jennings-core-transitive-trust-enrollment-01.txt,.pdf)
is a very good example for the kind of input document that we are looking for.

But it is just one way of doing things.  There are so many others.  To a large extent, the differences are not just based on technological choices, but on what people are actually trying to do with the smart objects, i.e., what purpose in life they have.

After half a decade of kicking around half-baked solutions in this space in various IETF working groups, I think it is a good idea to spend more time understanding the design space.  How, and where, to spend this time in the most productive way is what I would like to discuss with interested people before we do the SAAG slot: -> [email-masked]

Grüße, Carsten

PS. Here is section 3.3 of the CoRE roadmap I-D, which lists a couple more related drafts:

   Several individual drafts analyze the issues around the security of
   constrained devices in constrained networks.

  | draft-garcia-core-security                      |     | 2012-03-26 |
  | draft-sarikaya-core-sbootstrapping              | -05 | 2012-07-10 |
  | draft-jennings-core-transitive-trust-enrollment | -01 | 2012-10-13 |

   [I-D.garcia-core-security] in particular describes the "Thing
   Lifecycle" and discusses resulting architectural considerations.
   [I-D.jennings-core-transitive-trust-enrollment] demonstrates a
   specific approach to securing the Thing Lifecycle based on defined
   roles of security players, including a Manufacturer, an Introducer,
   and a Transfer Agent.

   Further work around Thing Lifecycles is also expected to occur in the
   SOLACE initiative (Smart Object Lifecycle Architecture for
   Constrained Environments), with its early mailing list at
   [email-masked] -- developed after the model of the COMAN initiative
   (Management for Constrained Management Networks and Devices,
   [email-masked], [I-D.ersue-constrained-mgmt]).

---

From: "Cullen Jennings (fluffy)" <[email-masked]>
Date: Sun, 4 Nov 2012 17:55:46 +0000

I have been doing some work with constrained devices and would be happy to talk about the problem in SAAG. I've spend a fair amount of time talking to few folks that I think of as part of the security mafia to try and understand how to describe some of the threats and try and get crisp about the overall goals - particularly in thinking about how the problem is different than security problems we have already solved. 

I do have a sketch of a proposed solution which I think helps people understand the problem but may or may not be the right path to a good solution.  If someone from the security community wanted to help me move this from a sketch to a well formed proposal, that would be great but I think the key thing for SAAG right now is the problem. 

I'm glad to do this with Carsten - he and I are at pretty opposite ends of the spectrum on some of this stuff but the union of our views likely covers a very large percentage of the broad communities views on the topic. 

Cullen

On Oct 29, 2012, at 14:45 , Stephen Farrell <[email-masked]> wrote:

> 
> Hiya,
> 
> So Carsten volunteered to give saag a heads-up on the
> problem this time. If he and Cullen want to arm-wrestle
> that's fine:-) I'm sure either would do a fine job.
> 
> I didn't mean to say anything about the solace draft
> being good, bad or indifferent. But I figured someone
> is working on this problem somewhere and would like
> to make sure that whatever solution looks like it'll
> be adopted is something that wouldn't cause saag folk
> to have fits.
> 
> Cheers,
> S.
> 
> On 10/29/2012 08:32 PM, Michael Richardson wrote:
>> 
>>>>>>> "Stephen" == Stephen Farrell <[email-masked]> writes:
>>   Stephen> Would it be timely to spend 10 minutes on this during the saag
>>   Stephen> session?
>> 
>> I think, if you want to talk something SOLACE related which is more
>> concrete than a possible SOLACE IRTF "charter", then maybe have Cullen
>> talk about:
>> 
>> http://www.lix.polytechnique.fr/hipercom/SmartObjectSecurity/papers/CullenJennings.pdf
>> http://www.lix.polytechnique.fr/hipercom/SmartObjectSecurity/slides/Cullen1.pdf
>> 
>>   Stephen> I'd really like that the security area not end up being surprised
>>   Stephen> by whatever is eventually decided so getting a presentation at
>>   Stephen> saag would be useful at the point where you more or less know
>>   Stephen> the direction, but are still flexible enough to deal with someone
>>   Stephen> who e.g. points out significant security issues.
>> 
>> Except that:
>> 1) the constrained devices are more constrained than the IP phones
>>  described.
>> 
>> 2) the constrained devices probably can not be attacked/p0wned until
>>  after they get on the network, and so actually authenticating to the
>>  network is the "application"
>> 
>> Cullen's slides provide a really good starting explanation.
>> While the details of the ultimate answer are going to be a bit different
>> in small ways,  the basic architecture he presents has been articulated
>> repeatedly by many.
>> 
>> So, if your aim is to get more security geeks thinking about attacks,
>> and about defenses, in advance of an actual proposed protocol (and
>> SOLACE is an I*R*TF group, recall. A protocol might not be the result
>> anyway), then I suggest giving Cullen a few minutes to talk about his
>> slide 7,8,9.
>> 
>>   Stephen> It might be that waiting another meeting cycle or two would be
>>   Stephen> better if the basic ideas aren't yet firmed up.
>> 
>> One meeting cycle won't help.  Four might.
>> 
> _______________________________________________
> 6lowpan mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/6lowpan