Subject: Re: [Ace] How to progress?

From: Rene Struik <[email-masked]>
Date: Thu, 28 Aug 2014 08:52:01 -0400

Hi Steffi:

Just curious: did you get any more feedback on your questions posed on 
the day of the ACE WG meeting in Toronto? So far, I have seen detailed 
feedback by Michael Richardson and myself and more general feedback by 
Hannes Tshofenig and Goran Selander, but I can imagine you received more 
feedback than just from these four persons off-list. If you feel a 
compilation of feedback would benefit the group, this may be a good 
thing to provide.

Best regards, Rene

On 7/23/2014 1:19 PM, Stefanie Gerdes wrote:
> Hi everyone,
>
> The discussion today and during the previous meetings made me think that
> there are still a lot of unspoken assumptions and requirements flying
> around. I think we won't be able to come to an agreement on a solution
> if we don't manage to identify the key assumptions and requirements.
> This is why I came up with a couple of questions which I think would
> help to explore the context of the problem we are trying to solve. I
> know that there will in most cases not be only one answer to these
> questions but I think we will need to get a feeling about the range of
> answers.
>
> These are the questions I came up with:
> 1. What categories of constrained devices do we want to support (C0, C1..)?
>    1a) What are the smallest devices we are going to support (RAM, ROM, etc)?
> 2. For each device in the architecture: What are the limitations of this
> device?
>    2a) Are the limitations always the same?
>    2b) How much can we gain from introducing less constrained actors?
> 3. What message sizes do we want to consider?
> 4. What are the application security requirements for the
>     communication between constrained nodes?
>    4a) Integrity
>    4b) Confidentiality
>    4c) Non-Repudiation
>    4e) ...
>    4f) Are all of these always needed?
> 5. Which level of security is needed on the devices (high, middle, low)?
>    5a) Do we always need devices to be tamper-proof?
> 6. How do the constraints of the nodes influence the protocols to be used?
> 7. Can we find a single protocol which supports all kinds of devices in
>    every part of the architecture?
> 8. What roles do proxies have that we want to support?
> 9. Do we need authorization without user interaction?
> 10. Which constraints concerning the connectivity of devices do we want
>     to support?
>    10a) "Offline" authorization (only some devices are "online", no
>         device is online, etc)
>    10b) Intermittent connectivity
>    10c) Special connectivity requirements (e.g. unidirectional links)
>
>
> I thought it might be helpful to collect the relevant questions and
> assumptions in a wiki: http://trac.tools.ietf.org/wg/ace/trac/wiki/Questions
>
> What do you think?
>
> Thanks,
> Steffi
>
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: Stefanie Gerdes <[email-masked]>
Date: Thu, 28 Aug 2014 15:49:07 +0200

Hi Rene,

I added the feedback from the people you mentioned and also tried to add
other aspects that people mentioned on the list, such as Kathleen's
comments to the use cases document. Moreover, I tried to transform the
questions to be more of a check list because of Kepeng's suggestion to
have yes/no questions.

The current version of the question is available in the wiki [1]. For
your convenience, I will also list them below.

I was on vacation the last two weeks and I'm just back in office today.
I'm still trying to catch up on things so I might have missed some stuff
that happened in the meantime.

Best regards,
Steffi

[1] http://trac.tools.ietf.org/wg/ace/trac/wiki/Questions

ACE: Exploring the Problem Space

1. What categories of constrained devices do we want to support (cf.
http://tools.ietf.org/rfc/rfc7228)?
 * C0 (data size << 10 KiB, code size << 100KiB) and above
 * C1 (data size ~ 10 KiB, code size ~ 100KiB) and above
 * C2 (data size ~ 50 KiB, code size ~ 250 KiB) and above
 * What are the smallest devices we are going to support (RAM, ROM, etc)?
2. What are the limitations of constrained devices?
 * Limited RAM, ROM
 * No user interfaces
 * Unable to precisely measure time
 * Limited ability to send / receive messages
 * Limited Energy
 * Are the limitations always the same?
3. Which configurations of constrainedness do we want to consider?
 * C and RS are constrained
 * C is constrained but RS is not
 * RS is constrained but C is not	
4. What can we gain from introducing less constrained actors?
 * Translate complex policies into authorization tokens which are easy
to validate
 * Providing the owner's policies without user interaction at the time
of authorization
 * Attribute Validation (does the entity in possession of a certain key
really posses the claimed attributes)
 * Providing a user interface to owners
 * Time Keeping
5. What are the limitations of less constrained actors?
6. What limitations of underlying protocols do we have to consider?
 * Frame size
7. What are the application security requirements for the communication
between constrained nodes?
 * Integrity
 * Confidentiality
 * Non-Repudiation
 * Privacy
 * ...
 * Are all of these always needed?
8. Which level of security is needed on the devices (high, middle, low)?
 * Do we need the constrained devices to have unique identities?
 * Do we always need devices to be tamper-proof?
 * Do we need tamper detection/auditing?
   * Logging / Protection of Logs / Purging
 * Do we need end to end security?
9. How do the constraints of the nodes influence the protocols to be used?
10. Can we find a single protocol which supports all kinds of devices in
every part of the architecture?
 * Communication between two constrained devices
 * Communication where one endpoint is constrained
 * Communication between less constrained devices as needed to transmit
the authorization information
11. What roles do proxies have that we want to support?
 * Reverse proxies
 * Forward proxies
 * Cross-protocol proxies
12. Do we need authorization without user interaction?
13. Which constraints concerning the connectivity of devices do we want
to support?
 * "Offline" authorization (only some devices are "online", no device is
online, etc)
    * RS may not be able to communicate with AS at the time of the
request from C.
    * C may not be able to communicate with AM at the time of the request.
    * C may not be able to communicate with AS at the time of the request.
    * C must be able to act on RS when both are disconnected from everything
 * Intermittent connectivity
 * Latency
 * Special connectivity requirements (e.g. unidirectional links)
 * Sleepy Devices
14. Do we need to consider problems concerning the lifecycle of devices
other than the operational phase?
 * Commissioning
 * Maintenance
 * Decommissioning
 * Handover
15. Do we need to consider specific threats?
 * Session intercept / hijacking
 * Monitoring