Subject: [Ace] draft-tschofenig-ace-overview-00.txt

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 16 Feb 2014 13:15:20 +0000

Hi all,

last Friday I have submitted a document that informs about available
three party authentication and authorization protocols developed in the
IETF.

The described security protocols are Kerberos, OAuth, ABFAB (which
builds on the AAA/EAP architecture), and the certificate/PKI model.
With each protocol I provide references to the relevant specifications
and a discussion about the pros & cons. As you can imagine, there was a
lot of standardization work on each of these protocols and quite
naturally there are many extensions available. Not all of them are
relevant for the IoT context.

I have not yet tried to map the features of the protocols against the
use cases and requirements since those are obviously still in flux. For
a future version of the document this is, however, the goal.

In any case, here is the document:
http://tools.ietf.org/html/draft-tschofenig-ace-overview-00

I am looking forward to see your reaction to the document.

Ciao
Hannes

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 19 Feb 2014 15:44:49 +0100

A quick comment about this part of section 3 :

>  It is, however, also worth noting that several aspects that are not
>    discussed in this document although they appear as requirements in
>    the use case document, namely
>
>    o  a language for describing access control policies,
>
>    o  the encoding of these policies, and
>
>    o  the container for associating these policies with keying material.

The use case document does not (and did never) require standardization 
of a language to describe access control policies. Which part of the 
document makes you think it does?

I guess what you had in mind where the authorization tokens, mentioned 
in draft-selander and draft-gerdes (and which are not mentioned in the 
use case document).
By my understanding, these tokens describe access control decisions and 
not access control policies (and I said so earlier).
I think we should standardize a representation of access control 
decisions but _not_  the underlying policies that lead to these decisions.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Göran Selander <[email-masked]>
Date: Fri, 28 Feb 2014 13:58:57 +0000

Hi Hannes,

I have read your draft and I think it is motivating well the usefulness of
a three party protocol and the candidate protocols in this context. I
would like to add to the list of candidate protocols the Multimedia
Internet KEYing protocol (MIKEY, RFC 3830), or more specifically
MIKEY-TICKET (RFC 6043).

MIKEY is a lightweight key management protocol designed for peer-to-peer,
one-to-many and small sized groups. MICKEY-TICKET is specifically
addressing the case of a trusted key management service (³Authorization
Server²) like other three party authentication protocols considered and
reuses the ticket concept from Kerberos, but also adds e.g. public-key
encryption-based key distribution and, as mentioned, group key management.
It also has the concept of ³Ticket Policy² containing certain
authorization information.

Clearly, Kerberos is more widely deployed, but I think this protocol
merits to be considered in the evaluation.

Göran