Re: [6tisch-security] Short address assignment

[Michael Richardson <[e-mail]>]

Tero Kivinen <[e-mail]> wrote:
    > During the teleconf I pointed out about the issues with the short
    > address assignments and security. This email provides background
    > information and explains the situation bit more.

thank you!

    > When using TSCH the situation is bit different as Frame counter is
    > replaced with network global ASN. This means that Source address part
    > needs to be unique for that timeslot. This means that coordinator

Attached below is a yang module to describe the short-address assignment.

    > PAN ID is added, as large networks might use multiple PANs, but still
    > use same secret key (it does not matter whether the ASNs are in sync or
    > not).

Do you think we should slip the PANID in with the short-address assignment?

We have not explained how the pledge knows about PANIDs: clearly it could
just use whatever PANID the beacons it hears contain.   Do you think we need
to be more explicit?

Perhaps we should at least put it in the yang model such that it read back?
I have included an inception date for the short-address for this reason as
well. I called it "effectiveat", but maybe there is a better name.

====

module ietf-6tisch-short-address {
  yang-version 1.1;

  namespace
    "urn:ietf:params:xml:ns:yang:6tisch-shortaddress";
  prefix "ietf6shortaddr";

  //import ietf-yang-types { prefix yang; }
  //import ietf-inet-types { prefix inet; }

  organization
   "IETF 6tisch Working Group";

  contact
   "WG Web:   <http://tools.ietf.org/wg/6tisch/>
    WG List:  <mailto:[e-mail]>
    Author:   Michael Richardson
              <mailto:[e-mail]>";

  description
   "This module defines an interface to set and interrogate the short (16-bit) layer-2 address
    used in 802.15.4 TSCH mode networks.  The short addresses are used in L2 frames
    to save space.  A lifetime is included in terms of TSCH Absolute Slot Number, which
    acts as a monotonically increasing clock.  ";

  revision "2017-03-01" {
    description
     "Initial version";
    reference
     "RFC XXXX: 6tisch minimal security";
  }

  // top-level container
  container ietf6shortaddresses {
    config false;
    description
      "A 16-bit short address for use by the node.";

    leaf shortaddress {
      type binary;
      length 2;
      mandatory true;
      description
        "The two byte short address to be set.";
    }
    leaf validuntil {
      type uint32;
      description "The Absolute Slot Number/256 at which the address ceases to be valid.";
      mandatory true;
    }

    leaf effectiveat {
      type uint32;
      description "The Absolute Slot Number/256 at which time the address was originally set. This is a read-only attribute that records the ASN when the shortaddress element was last written or updated.";
      mandatory false;
    }
  }
}


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-