Subject: [Ace] 6tisch requirements for ACE BOF

From: Michael Richardson <[email-masked]>
Date: Mon, 03 Feb 2014 12:27:49 -0500

<#secure method=pgpmime mode=sign>

hello BOF chairs,

In discussions in 6tisch, we have come to the conclusion that we will want to
leverage the ACE work.   To that end, we would like to speak a bit about our
specific requirements.  

I will be preparing two slides, which I will send prior to Feb 14.

The written details of the requirements will find their way into
       draft-richardson-6tisch-security-architecture-01
(not yet posted)

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: Ludwig Seitz <[email-masked]>
Date: Tue, 04 Feb 2014 09:22:12 +0100

>         draft-richardson-6tisch-security-architecture-01

I'd be very happy to hear about your usecases and requirements.

If you want I can try to integrate them into a future version of 
draft-seitz-core-aa-usecases  (soon to become something like 
draft-seitz-ace-usecases).

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 5 Feb 2014 13:57:01 +0100 (CET)

Hi Michael, 
 
thanks for the note. 
 
I have not been following 6tisch nor have I looked at the 802.15.4e specification. 
 
It seems, however, very useful to decouple the physical layer / link layer from the higher layers. 
 
The security architecture document  
http://tools.ietf.org/html/draft-richardson-6tisch-security-architecture-00
currently doesn't contain a lot of information. 

Where are use cases document that are used to derive the requirements? 

Ciao
Hannes

Gesendet: Montag, 03. Februar 2014 um 17:27 Uhr
Von: "Michael Richardson" <[email-masked]>
An: [email-masked]
Betreff: [Ace] 6tisch requirements for ACE BOF
<#secure method=pgpmime mode=sign>

hello BOF chairs,

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Michael Richardson <[email-masked]>
Date: Wed, 05 Feb 2014 12:11:58 -0500

> currently doesn't contain a lot of information. 

No, that's just an empty document at present.

The summary of use cases:
    1) authorization for a mote to join the network
    2) authorization for a PCE to program a time slot schedule into the mote

One thing we have discussed, and which has precedence from
ISA100/WirelessHart is that the credentials to join the network are provided
as a part of the mote being programmed.  That is, the detailed security
credentials are just yet another detail that a central authority (like the "PCE") 
is going to program into the device.

We would like to be able to either create a single (D)TLS session (with a
saved rfc5077 ticket), and keep that around for further updates to both L2
and L3 configuration.  (Likely using COAP/BSON or some such)

---

From: Göran Selander <[email-masked]>
Date: Thu, 6 Feb 2014 07:55:09 +0000

Hi Michael,

I¹m not familiar with the setting, a few questions below

>    1) authorization for a mote to join the network

What credentials, if any, are assumed in the mote at the time of enforcing
the authorisation decision?

>    2) authorization for a PCE to program a time slot schedule into the

Is this PCE fixed, or is there any change of PCE or other node that needs
to be authorised to access the mote during its lifetime?

>is going to program into the device.

Relating to the question above, what credentials, if any, are assumed
before the programming of the mote? Does the use case match one of the
assumptions in 
http://www.ietf.org/mail-archive/web/ace/current/msg00105.html ?

Göran

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 24 Feb 2014 11:58:39 +0100

Hi Michael,

the IETF document submission deadline has passed and I noticed that there is no new version of draft-richardson-6tisch-security-architecture available.

Hence, there is essentially no publically available content and I wonder how well your views are aligned with the rest of the 6tisch group.

Do you understand that I am a bit nervious?

Ciao

Hannes

Gesendet: Mittwoch, 05. Februar 2014 um 18:11 Uhr

An: [email-masked]

Betreff: Re: [Ace] 6tisch requirements for ACE BOF

--

Ace mailing list

[email-masked]

---

From: Michael Richardson <[email-masked]>
Date: Mon, 24 Feb 2014 09:33:07 -0500

>Hi Michael,
>
>the IETF document submission deadline has passed and I noticed that there is no
>new version of draft-richardson-6tisch-security-architecture available.

Yes, I was down to the last minute, and child NMI was pushed, and I missed
submission deadline. I'm more upset about that than you!

>Hence, there is essentially no publically available content and I wonder how
>well your views are aligned with the rest of the 6tisch group.
>

The 6tisch security design team has had multiple telecons since Xmas.

I will shortly (today) send you some slides.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting for hire =-

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 24 Feb 2014 15:37:01 +0100

Thanks for providing some slides upfront.

I am not upset but I can already hear the first person saying "why is he allowed to present and I am not."

Ciao

Hannes

Gesendet: Montag, 24. Februar 2014 um 15:33 Uhr

An: "Hannes Tschofenig" <[email-masked]>

Cc: [email-masked]

Betreff: Re: Aw: Re: [Ace] 6tisch requirements for ACE BOF

--

---

From: Michael Richardson <[email-masked]>
Date: Mon, 24 Feb 2014 10:19:38 -0500

Weirdly, my MUA just won't quote your email.  I have to copy and paste directly.
Something about the header parsing in mh-e/supercite.

> allowed to present and I am not."

I agree... it's unfair. put me at the end of the agenda... I might fall off!

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 24 Feb 2014 20:35:36 +0100

On 24 Feb 2014, at 15:37, Hannes Tschofenig <[email-masked]> wrote:

> I am not upset but I can already hear the first person saying "why is he allowed to present and I am not.” 

There is also the concern that 6TiSCH may lead the audience a bit astray, away from the core use cases of ACE.
Not many people know about 6TiSCH, so focusing on this use case may create more confusion than it adds elucidation.
I wouldn’t want the BOF being jeopardized by a scope debate we don’t need: ACE is about authenticated authorization of applications.
(If ACE work turns out to be useful for adaptation layer security, too, I’m certainly fine with that.)

Grüße, Carsten

---

From: Göran Selander <[email-masked]>
Date: Tue, 25 Feb 2014 08:05:43 +0000

Hi Michael

If you prepare a presentation: I sent you some questions in a previous
mail of this thread which you may want to consider.

http://www.ietf.org/mail-archive/web/ace/current/msg00204.htm

Göran

---

From: Likepeng <[email-masked]>
Date: Tue, 25 Feb 2014 08:10:30 +0000

>http://www.ietf.org/mail-archive/web/ace/current/msg00204.htm

404: Page Not Found.

Can you check the link?

Thanks,

Kind Regards
Kepeng

> -----邮件原件-----
> 发件人: Ace [mailto:[email-masked]] 代表 G?ran Selander
> 发送时间: 2014年2月25日 16:06
> 收件人: Michael Richardson; Hannes Tschofenig
> 抄送: [email-masked]
> 主题: Re: [Ace] 6tisch requirements for ACE BOF
> 
> Hi Michael
> 
> If you prepare a presentation: I sent you some questions in a previous mail of
> this thread which you may want to consider.
> 
> >]     [email-masked]  http://www.sandelman.ca/        |   ruby
> on rails
> >   [
> >
> >

---

From: Göran Selander <[email-masked]>
Date: Tue, 25 Feb 2014 08:19:43 +0000

Sorry, an ‘l’ missing, here is the link:

http://www.ietf.org/mail-archive/web/ace/current/msg00204.html

Göran

On 25/02/14 09:10, "Likepeng" <[email-masked]> wrote:

>>mail of

---

From: Olaf Bergmann <[email-masked]>
Date: Tue, 25 Feb 2014 09:34:41 +0100

>>http://www.ietf.org/mail-archive/web/ace/current/msg00204.htm

Just got truncated:

Gruesse
Olaf

---

From: Michael Richardson <[email-masked]>
Date: Tue, 25 Feb 2014 09:12:33 -0500

Carsten Bormann <[email-masked]> wrote:
    > There is also the concern that 6TiSCH may lead the audience a bit
    > astray, away from the core use cases of ACE.

Perhaps this is why it is important to describe the use case, because it's
not just about adaptation layer security.