Subject: Re: [Secdispatch] EDHOC Summary

From: Göran Selander <[email-masked]>
Date: Thu, 18 Apr 2019 07:47:18 +0000

Hi Hannes, 

On 2019-04-16, 09:26, "Secdispatch on behalf of Hannes Tschofenig" <[email-masked] on behalf of [email-masked]> wrote:

    >     Richard Barnes <[email-masked]> wrote:
    >         > I'd like to push back on this point. It may be that EDHOC has been around for
    >         > a while and been well-socialized with the IoT crowd, but it is clearly
    >         > deficient in several other types of maturity, e.g., robustness of formal
    >         > analyses and state of implementations (AFAICT).
     
    I would like to point out that initially the work on EDHOC was intentionally not positioned as a TLS replacement (or even competitor). For years I was told that it is supposed to be used in addition to and on top of TLS. Fast forward a few years the story is very different now. 

[GS] The AKE for OSCORE clearly must support the same transport as OSCORE. From first individual submission to the approved version of OSCORE, the introduction section states that OSCORE may or may not be used over TLS/DTLS. (The approved version recommends the use of additional TLS for certain hops, but not over constrained networks.) OSCORE/AKE over TLS is similar to TLS over IPsec/IKEv2.

Göran

This type of positioning helps you to avoid dealing with a number of folks in the IETF (in this case with the TLS crowd) but it does not help in the long run.
     
    Ciao
    Hannes
     
    PS: FWIW this is not the first time this has happened. ANIMA wasn’t any different when the proponents claimed that IoT was out of scope.

    IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose,
     or store or copy the information in any medium. Thank you.

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 18 Apr 2019 11:00:53 +0000

Hi Goeran,

 [GS] The AKE for OSCORE clearly must support the same transport as OSCORE.

No, it doesn't.

> From first individual submission to the approved version of OSCORE, the introduction section states that OSCORE may or may not be used over TLS/DTLS.
> (The approved version recommends the use of additional TLS for certain hops, but not over constrained networks.)
You see what I am talking about...

> OSCORE/AKE over TLS is similar to TLS over IPsec/IKEv2.
You know that nobody uses IPsec / IKEv2 in an IoT context (even though some of your co-workers even argued for it some time ago).

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Göran Selander <[email-masked]>
Date: Thu, 18 Apr 2019 12:11:31 +0000

Hi Hannes,

On 2019-04-18, 13:01, "Hannes Tschofenig" <[email-masked]> wrote:

    Hi Goeran,

    No, it doesn't.

[GS] Strike "clearly", this is a requirement coming from use cases implementing OSCORE and in need for an AKE.

[GS] No. 

[GS] The analogy I wanted to make is that security protocols may be applied at multiple layers on a particular leg of a communication path.
This has nothing to do with IoT context.

Göran

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 18 Apr 2019 12:20:51 +0000

Hi Goeran,

Hi Hannes,

    Hi Goeran,

    No, it doesn't.

[Hannes] I don't see where this requirement comes from. From the DTLS/TLS experience I have seen several solutions in the IETF where the handshake was separate from the protection of the data.
It wasn't a problem there...

I actually see advantages if we untangle it from the transport because we keep inventing new transports. FWIW I see QUIC as a new transport as well and one that has not been explored enough in the IoT space.

[GS] No.

[Hannes] First you say "it may be used over TLS/DTLS" even in the draft. Later, you add that it shouldn't be done over constrained networks. I am sure I can dig out meeting meetings where you deny that OSCORE/EDHOC are in any competition to TLS/DTLS.

[Hannes] But it was a good example because back then I was also the only one voicing concerns about the large number of security options we provide in the IoT space. It seems that you agree with me in the meanwhile. More options does not necessarily lead to better interoperability.

Ciao
Hannes

Göran

---

From: Göran Selander <[email-masked]>
Date: Thu, 18 Apr 2019 12:55:11 +0000

Hi Hannes,

On 2019-04-18, 14:21, "Secdispatch on behalf of Hannes Tschofenig" <[email-masked] on behalf of [email-masked]> wrote:

        No, it doesn't.

    

[GS] The context is this: OSCORE is deployed over a number of hops with different transports. The key exchange protocol must at least be able to travel the same path.

    [GS] No.
    
    [Hannes] First you say "it may be used over TLS/DTLS" even in the draft. Later, you add that it shouldn't be done over constrained networks. 

[GS] I don't understand how you got from "it may be used over TLS/DTLS" which has been stated in the draft since day 0 to "it must be used with TLS/DTLS" which never has been stated in the draft. The draft does not state "it must/should not be used with TLS/DTLS"  -- you may deploy OSCORE and TLS/DTLS in tandem if you like.

I am sure I can dig out meeting meetings where you deny that OSCORE/EDHOC are in any competition to TLS/DTLS.
    
[GS] Be my guest.

    
    
[GS] I did not make any statement about the use of IPsec for IoT. I just wanted to explain the analogy.

Göran

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 18 Apr 2019 14:54:54 +0000

Hi Goeran,

> [GS] The context is this: OSCORE is deployed over a number of hops with different transports. The key exchange protocol must at least be able to travel the same path.

This is now a different requirement than stated previously. We are making progress.

Ciao
Hannes

PS: I would like to hear more about this deployment of OSCORE over multiple hops with different transports.

---

From: Göran Selander <[email-masked]>
Date: Thu, 18 Apr 2019 15:07:35 +0000

On 2019-04-18, 16:55, "Hannes Tschofenig" <[email-masked]> wrote:

    Hi Goeran,

   
[GS] No, this is the requirement "the AKE should support the same transport as OSCORE". That does not exclude that the AKE supports other transport.

Göran

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 18 Apr 2019 15:17:34 +0000

Hi Goeran,

Do you notice there is a difference between

"the AKE should support the same transport as OSCORE"

and

"The key exchange protocol must at least be able to travel the same path."

Ignoring the difference between the 'should' and the 'must' I wonder whether I could run a DTLS/TLS handshake between the two endpoints and then derive keys for OSCORE and whether that would still be OK in your view.

Ciao
Hannes

-----Original Message-----
From: Göran Selander <[email-masked]>
Sent: Donnerstag, 18. April 2019 17:08
To: Hannes Tschofenig <[email-masked]>; Owen Friel (ofriel) <[email-masked]>; Richard Barnes <[email-masked]>; Michael Richardson <[email-masked]>
Cc: Carsten Bormann <[email-masked]>; [email-masked]; Martin Thomson <[email-masked]>
Subject: Re: [Secdispatch] EDHOC Summary

    Hi Goeran,

Göran

---

From: Göran Selander <[email-masked]>
Date: Thu, 18 Apr 2019 15:30:23 +0000

Hi Hannes,

Why don't you and I celebrate Easter together? We will be staying in a nice place, you are welcome to join for endless discussions __

On 2019-04-18, 17:17, "Secdispatch on behalf of Hannes Tschofenig" <[email-masked] on behalf of Hi [email-masked]> wrote:

    Hi Goeran,

    
    and

    Ignoring the difference between the 'should' and the 'must' 

[GS] Sure, there is no grading of the requirements.

I wonder whether I could run a DTLS/TLS handshake between the two endpoints and then derive keys for OSCORE and whether that would still be OK in your view.

[GS] Yes, if over the same transport. 

Göran

    -----Original Message-----
    From: Göran Selander <[email-masked]>
    Sent: Donnerstag, 18. April 2019 17:08
    To: Hannes Tschofenig <[email-masked]>; Owen Friel (ofriel) <[email-masked]>; Richard Barnes <[email-masked]>; Michael Richardson <[email-masked]>
    Cc: Carsten Bormann <[email-masked]>; [email-masked]; Martin Thomson <[email-masked]>
    Subject: Re: [Secdispatch] EDHOC Summary

    
        Hi Goeran,

    
    
    Göran

    IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
    _______________________________________________
    Secdispatch mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/secdispatch

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 18 Apr 2019 16:34:56 +0000

> Why don't you and I celebrate Easter together? We will be staying in a nice place, you are welcome to join for endless discussions __

I had to laugh. Let's continue after the Easter holiday.