Subject: [6tisch-security] minutes of the 2014-11-04 6TiSCH call

From: Michael Richardson <[email-masked]>
Date: Thu, 20 Nov 2014 17:30:01 -0500

Attending:
 - Thomas
 - Michael
 - Jonathan
 - Kris
 - Pascal

In this call we returned to getting section 3 ready for proposing 
as part of the 6tisch architecture.  This resulted in the post at:
   http://www.ietf.org/mail-archive/web/6tisch/current/msg02690.html

These minutes describe how we got to this text.

We returned to the question:
  * how do we get communication between the joining node and the JCE?
    * IP-IP tunnel between join assistant and JCE
    * use pre-existing DODAG, DAO sent up to parent and DODAG root, informing existence
    * second DODAG. non-storing 
    * (not exclusive) 6TiSCH track for join traffic

We discussed the last item for awhile in the context of Deterministic
Ethernet and other 6tisch track allocations.   We discussed how we could use
the track and QoS features to either protect the network from DDoS from
joining nodes, or alternatively, lower the time for a network to form by
allocating more bandwidth.

We came back to the question:
   "does the JCE have connectivity to joining node?" (and how)

After much discussion we came to the conclusion in the 2014-11-04 discussion
that we would use the existinng DODAG, even if it was a storing DODAG.

  * MR: part of goal is to prevent DoS. If we agree that in general in a
      6TiSCH network, we can replace networks with 6TiSCH tracks, that's a
      possibilty. We can add QoS on those tracks. Maybe we don't need to think
      too hard about option 4. 

Near the end of the discussion a new option was proposed, which is to not
have the joining node join the DODAG (the Join Assistant would send a DAO on
behalf of the joining node), but rather for the JCE to use loose source
routing to reach the Joining Node.  The JCE would send via the Join
Assistant, and it would get that address from the DAR message that the 6LBR
would share. 

At the end of this meeting, mcr took the action to update the document, which
was included in the text pointed to above.

Just prior to the 6tisch meeting, it was pointed out that the we couldn't,
according to specification, put link local addresses into the RH2, because
their link scope would be unclear.  We are investigating what other options
we have, because the resulting system has very little state per joining node.

====

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Thomas Watteyne <[email-masked]>
Date: Thu, 20 Nov 2014 22:51:47 -0800

Michael,

[adding 6TiSCH ML]

I have archived those minutes at
https://bitbucket.org/6tisch/meetings/wiki/141104_webex_security for
completeness.

In the process, I made the changes below, please let me know if that
doesn't work for you:

OLD:
 - Thomas
 - Michael
 - Jonathan
 - Kris
 - Pascal
NEW:
 - Thomas Watteyne
 - Michael Richardson
 - Jonathan Simon
 - Kris Pister
 - Pascal Thubert

OLD:
Just prior to the 6tisch meeting,
NEW:
Just prior to the 6tisch WG meeting at IETF91,

Thomas

On Thu, Nov 20, 2014 at 2:30 PM, Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> 6tisch-security mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/6tisch-security
>
>

---

From: Michael Richardson <[email-masked]>
Date: Thu, 27 Nov 2014 19:45:03 -0500

We will meet on the next three Tuesdays: 
   2014-12-02,2014-12-09,2014-12-16.
at 11am.  I have left the webex recurrance until end of January, but we will
not meet 2014-12-23, 2014-12-30.  We will likely meet on 2015-01-06,2015-01-13.
[if you want to be on my calendar invite, unicast me]

Here is the webex info:
  Meeting number: 641 709 118
  Meeting password: joinjoin
  Audio connection:
    1-877-668-4493 Call-in toll free number (US/Canada)
    1-650-479-3208 Call-in toll number (US/Canada)
Access code: 641 709 118
Meeting link:
  https://ietf.webex.com/ietf/j.php?MTID=m1aa12258a83109b4ae291fb0c2bd92d6 

The topic for next week is about the suggested text which was suggested two
weeks ago.  It's not perfect yet, and we need perhaps to clarify some things.
There is an existing thread about some of the technical assumptions, which
I will list here:
  - join network encrypted or not, and related issues
  - authentication and authorization mechanisms
  - 6top/YANG specifics
  - document structural issues (where does the rest of the protocol go)

The SecDir secretary, Tero Kivinen has assigned two people to do an early
review of this join protocol; he assigned himself and Hilarie Orman.
At some point, we may want to have them join our call; I leave the timing up
to them.  

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: <[email-masked]>
Date: Fri, 28 Nov 2014 01:59:02 +0000

In which time zone is 11am?  If it is 11am PST or EST, it is too inconvenient for Asian members to join.
Maybe what I can do is read minutes after the calls and send my comments / opinions over email.

Yoshihiro Ohba

-----Original Message-----
From: 6tisch-security [mailto:[email-masked]] On Behalf Of Michael Richardson
Sent: Friday, November 28, 2014 9:45 AM
To: [email-masked]
Subject: [6tisch-security] agenda for upcoming 6tisch security calls

We will meet on the next three Tuesdays: 
   2014-12-02,2014-12-09,2014-12-16.
at 11am.  I have left the webex recurrance until end of January, but we will not meet 2014-12-23, 2014-12-30.  We will likely meet on 2015-01-06,2015-01-13.
[if you want to be on my calendar invite, unicast me]

Here is the webex info:
    1-650-479-3208 Call-in toll number (US/Canada) Access code: 641 709 118 Meeting link:

The topic for next week is about the suggested text which was suggested two weeks ago.  It's not perfect yet, and we need perhaps to clarify some things.
There is an existing thread about some of the technical assumptions, which I will list here:
  - join network encrypted or not, and related issues
  - authentication and authorization mechanisms
  - 6top/YANG specifics
  - document structural issues (where does the rest of the protocol go)

The SecDir secretary, Tero Kivinen has assigned two people to do an early review of this join protocol; he assigned himself and Hilarie Orman.
At some point, we may want to have them join our call; I leave the timing up to them.

---

From: Rene Struik <[email-masked]>
Date: Thu, 27 Nov 2014 21:42:04 -0500

Dear colleagues:

Why not having the call at a time that does tries and accommodate 
everyone's time zone to the largest degree possible?

I suggest 9am EST = 6am PST = 3pm Paris = 11pm Japan. This should allow 
people to have their private time in the 12am-6am time window. {Other 
groups do a much better job at this...}

I would like to present in more detail the security architecture I 
described at IETF-91.

First, though, I would like us to agree on security objectives (as were 
on my slides in Honolulu).

All to be discussed on the call (I do respect peoples' important 
holidays in the year).

Best regards, Rene

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: Subir Das <[email-masked]>
Date: Fri, 28 Nov 2014 08:23:59 -0500

Thanks for arranging the calls. It would be good to accommodate Asian time
zone for broader participation. I would suggest choosing a time that is
more or less convenient for everyone. One other option could be cycle the
time so that everyone gets their favorite time zone.  I understand that it
is difficult to match with three continent's time zone  but it is
possible.

-Subir

---

From: Michael Richardson <[email-masked]>
Date: Fri, 28 Nov 2014 10:32:39 -0500

> We will meet on the next three Tuesdays: 

Sorry, it's 11am Eastern.  That's 8am Pacific, 11pm Beijing.

---

From: <[email-masked]>
Date: Fri, 28 Nov 2014 15:38:03 +0000

11am Eastern is actually 0am Beijing and 1am Tokyo next day (it's not Daylight Saving time now).

Yoshihiro Ohba

---

From: Michael Richardson <[email-masked]>
Date: Fri, 28 Nov 2014 10:39:29 -0500

> zone for broader participation. I would suggest choosing a time that is

I'm happy to do this at another time; the original choice of 11am Eastern was
to accomodate Pacific Time Zone People who couldn't meet before 8am.  

From long experience, our choices essentially are at 15:00 UTC or 03:00 UTC.
    07:00 Pacific/10:00 Eastern / 17:00 Helsinki/22:00 Beijing
or
    19:00 Pacific/22:00 Eastern / 05:00 Helsinki/10:00 Beijing

I am also happy to alternate.
Shall I put up a doodle poll?

---

From: Michael Richardson <[email-masked]>
Date: Fri, 28 Nov 2014 10:40:50 -0500

Rene Struik <[email-masked]> wrote:
    > First, though, I would like us to agree on security objectives (as were on my
    > slides in Honolulu).

You are most welcome to send text that we can comment on.

---

From: Rene Struik <[email-masked]>
Date: Fri, 28 Nov 2014 11:02:13 -0500

Dear colleagues:

I have set up a conf call for Tuesday December 2, 2014 at a time that 
tries and accommodate people in different time zones to the largest 
extent possible, without trying to discriminate against various parts of 
the world.

Please see dial-in information below.

Agenda to follow Monday around noon.

Looking forward to a collaborative meeting, in good spirit.

Best regards, Rene

==

1.Please join my meeting.

https://global.gotomeeting.com/join/594299061

2.Use your microphone and speakers (VoIP) - a headset is recommended.Or, 
call in using your telephone.

Dial +1 (647) 497-9351

Access Code: 594-299-061

Audio PIN: Shown after joining the meeting

Meeting Password: collaborate

Meeting ID: 594-299-061

GoToMeeting®

Online Meetings Made Easy®

Not at your computer? Click the link to join this meeting from your 
iPhone®, iPad®, Android® or Windows Phone® device via the GoToMeeting app.

[excerpt email as of Thu November 27, 2014, 9.42pm EST]
I suggest 9am EST = 6am PST = 3pm Paris = 11pm Japan. This should allow 
people to have their private time in the 12am-6am time window. {Other 
groups do a much better job at this...}

---

From: Thomas Watteyne <[email-masked]>
Date: Sat, 29 Nov 2014 07:14:22 -0800

Rene, Michael,

I'm totally confused now.

There are 2 call-in details out for December 2:
- http://www.ietf.org/mail-archive/web/6tisch-security/current/msg00279.html
at 7am PST, from Michael, proposing to discuss the text submitted to secdir
- http://www.ietf.org/mail-archive/web/6tisch-security/current/msg00287.html
at 6am PST, from Rene, "agenda to follow Monday around noon"

I assume those e-mails crossed one another.

I'll let *Jonathan* and *Kris* comment on their availability at 6am PST.

Thomas

On Fri, Nov 28, 2014 at 8:02 AM, Rene Struik <[email-masked]> wrote:

> tries and accommodate people in different time zones to the largest extent
> possible, without trying to discriminate against various parts of the world.
>
>
>  1.  Please join my meeting.
>
> 2.  Use your microphone and speakers (VoIP) - a headset is recommended.  Or,
> Subir Das <[email-masked]> <[email-masked]> wrote:
> 6tisch-security mailing [email-masked]://www.ietf.org/mailman/listinfo/6tisch-security
>
>
>
> --