Subject: [Ace] draft-seitz-core-sec-usecases

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 5 Feb 2014 14:35:57 +0100 (CET)

Hi all,

I think that draft-seitz-core-sec-usecases is (from my reading) the most suitable document for the BOF discussions related to the use cases.

Hence, I was wondering whether it would make sense to update draft-seitz-core-sec-usecases to update the document to

a)  update the existing use cases and to add more use cases,

b) change the abstract, title and the introduction (*)

c) submit the document as draft-seitz-ace-use-cases-00 to associate it to this effort.

(*): The use cases do not have anything to do with CoAP as well. Even without CoAP the use cases should still be valid. There is no need to mention CORE (the working group) nor the CoAP protocol anywhere.

I would also remove the references to DTLS, and the JOSE work since they are misplaced in a use case/requirements document.

Ciao

Hannes

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 5 Feb 2014 15:01:30 +0100

> I would also remove the references to DTLS, and the JOSE work since they are misplaced in a use case/requirements document. 

I would like to offer my strong opposition to widening the scope of ACE uncontrollably.

ACE is about CoRE.

(Two protocols CoRE uses are CoAP and DTLS.)

Trying to redact this from the use cases document doesn’t do any good.

Rather, I’d try to anchor the use cases (and in particular any technical requirements we derive from them) even more explicitly in what we are trying to achieve here.  For instance, it is rather important to think about which parts of the use cases already are covered by e.g. today’s protocols for the Browser web and which actually do need ACE work.  Those that do should use what we have and not independently invent another parallel world just to be “orthogonal".

Grüße, Carsten

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 05 Feb 2014 17:51:39 +0100

On 02/05/2014 02:35 PM, Hannes Tschofenig wrote:
> Hi all,
> I think that draft-seitz-core-sec-usecases is (from my reading) the most
> suitable document for the BOF discussions related to the use cases.
> Hence, I was wondering whether it would make sense to
> update draft-seitz-core-sec-usecases to update the document to
> (*): The use cases do not have anything to do with CoAP as well. Even
> without CoAP the use cases should still be valid. There is no need to
> mention CORE (the working group) nor the CoAP protocol anywhere.
> I would also remove the references to DTLS, and the JOSE work since they
> are misplaced in a use case/requirements document.
> Ciao
> Hannes

Hannes,

I'm in process of updating the draft,

a.) I have solicited use cases from various persons in order to get 
closer to the industry needs, but I haven't got a lot of input yet. 
Hint, hint ...

b.) I think it should be adapted to ACE, I do agree with Carsten that we 
shouldn't move the focus too much away from CoAP (although I'd 
personally like to talk about object security as an alternative to DTLS, 
if there are any buyers)

c.) I'll try to get it ready before the cutoff date, I take it that it's 
ok to submit drafts linked to efforts that are at BoF stage.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 5 Feb 2014 18:05:04 +0100 (CET)

Hi Ludwig,

comments below.

Gesendet: Mittwoch, 05. Februar 2014 um 16:51 Uhr

Von: "Ludwig Seitz" <[email-masked]>

An: [email-masked]

Betreff: Re: [Ace] draft-seitz-core-sec-usecases

> c) submit the document as draft-seitz-ace-use-cases-00 to associate it

> to this effort.

Hannes,

Hint, hint ...

[hannes] Well. You are one of the document authors and so it is always challenging to expect others to do the work ....

;-)

if there are any buyers)

[hannes] This work is not a competitor to DTLS. It does something different. You also need to explain me why the use cases depend on CoAP. I don't get it.

[hannes] Thanks. Get it submitted ASAP.

Ciao

Hannes

/Ludwig

--

Ludwig Seitz, PhD

SICS Swedish ICT AB

Ideon Science Park

Building Beta 2

Scheelevägen 17

SE-223 70 Lund

Phone +46(0)70-349 92 51

http://www.sics.se

_______________________________________________

Ace mailing list

[email-masked]

https://www.ietf.org/mailman/listinfo/ace

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 5 Feb 2014 18:18:37 +0100

On 05 Feb 2014, at 17:51, Ludwig Seitz <[email-masked]> wrote:

> I'd personally like to talk about object security as an alternative to DTLS, if there are any buyers)

Clearly, we have several use cases that need security beyond CoAP proxies.

In recent discussions here, components we might use came to mind including:

— tunnel a TLS handshake through the proxies.  Since we are already examining carrying elements of the DTLS handshake in CoAP transactions for performance reasons in direct DTLS connections, that mode comes  as a surprisingly cheap way to get keys.
— use OAuth constructions to carry keying material down from the Browser web.
— use JOSE to package objects, either as-is (JSON) or in a CBOR variant.

I haven’t made up my mind what the role of ACE would be in all this.
But it should be thought through.

Does this need to be in the initial charter?

Grüße, Carsten

---

From: Ludwig Seitz <[email-masked]>
Date: Thu, 06 Feb 2014 07:27:09 +0100

On 02/05/2014 06:05 PM, Hannes Tschofenig wrote:
[snip]
> [hannes] Well. You are one of the document authors and so it is always
> challenging to expect others to do the work ....
> ;-)
>

Why do you interpret this in the least favorable way, is that an old 
hands IETF experience? ;-)

Allow me to clarify: I'm offering people with a good industry use case 
to write it into the draft for them, if they provide me with enough 
detail. I'm also willing to let them do the work themselves if they insist.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Thu, 6 Feb 2014 10:44:27 +0100 (CET)

I think it is a good question for a potential working group to think about the layer at which security is provided.

In OAuth, for example, we have initially focused very much on re-using transport layer security since otherwise you replicate the functionality again at the high layer.

Kerberos, as another example, does not follow that design.

We would have to make a decision about this fairly early on because it has substantial implications.

I will add it to the open issue list.

I am not sure I would add these type of things into the charter. The charter is supposed to tell on a high level what the groups is trying to do; it is a sort of marketing material but not a design document.

Ciao

Hannes

Gesendet: Mittwoch, 05. Februar 2014 um 17:18 Uhr

Von: "Carsten Bormann" <[email-masked]>

An: "Ludwig Seitz" <[email-masked]>

Cc: [email-masked]

Grüße, Carsten

Ace mailing list

[email-masked]

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Thu, 6 Feb 2014 10:50:02 +0100 (CET)

Hi Carsten,

I appreciate your excitment about CoAP but if you read through the document then you will see that it is

a) is a use case and requirements document, and

b) stays at a much higher level: E.g., John uses a heart rate monitor and wants to give access to the data to a medical team but not to an insurance company. Jane delegates access to her house to Jeffrey temporarily.

The CORE and CoAP relationship is only of historical relevance.

I suggest not to confuse the reader.

Ciao

Hannes

Gesendet: Mittwoch, 05. Februar 2014 um 14:01 Uhr

An: "Hannes Tschofenig" <[email-masked]>

Cc: "[email-masked]" <[email-masked]>

ACE is about CoRE.

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 6 Feb 2014 11:03:11 +0100

> a) is a use case and requirements document, and 

Of course, but requirements for what?

Use cases should focus on those that make use of communicating constrained devices.

Any technical requirements derived from those use cases should be based on the assumption that we will be able to make use of components such as IP, CoAP, and DTLS.

The IP part may seem obvious here because this is the IETF.  I just want to make sure it’s as obvious, from reading the document, that we assume the presence of CoAP and DTLS.

Grüße, Carsten