Re: [6tisch-security] people who have responded -- planned meetings

[Michael Richardson <[e-mail]>]

Thomas Watteyne <[e-mail]> wrote:
    > Great! I would like to move fast on this, and suggest to have the
    > security
    > call at least 24 before the meeting so that we can complete the action
    > items
    > we will have discussed by the time of the 6TiSCH call.

I had already proposed to have the meeting 45 minutes before the 6tisch call,
but to do it weekly.


    > Would Thursday 7am Pacific (same time as 6TiSCH meeting) work for all?

It would not work for me on a sufficient number of Thursdays that it would be
a problem.

Thomas Watteyne <[e-mail]> wrote:
    > Would you agree that the agenda for the next sec meeting is to identify
    > the potential for using Object Security for secure joining a 6TiSCH
    > network, and that the homework to prepare is to read:

    > - [high] draft-selander-ace-object-security
    > - [med] draft-ietf-cose-msg
    > - [low] draft-selander-ace-cose-ecdhe
    > - [low] draft-hartke-core-e2e-security-reqs
    > - [low] draft-ietf-ace-oauth-authz

I'm fortunate that I've read most of these documents in detail.
I agree that this is an important thing to consider.

I want to point out that OSCOAP does not have a clear session key exchange
protocol as yet (several ideas proposed), and once it does, it still needs to
do enough certificate processing and ownership voucher analysis to enable the
security.

I had proposed DTLS/COAP (are we calling this coaps yet.. rhymes with soaps?)
with blockwise support.  From my point of view, sitting inside the
unconstrained JCE, it matters little if it's OSCOAP (security inside COAP) vs
DTLS/COAP (security outside of COAP).  They seem to have the same essential
properties in the end.

**to the constrained node it matters that we reuse as much code as possible**

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-