IETF Logo Mail Archive

Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted

Michael Richardson <mcr+ietf@sandelman.ca> Mon, 14 November 2016 07:18 UTC

Return-Path: <mcr@sandelman.ca>
X-Original-To: 6tisch-security@ietfa.amsl.com
Delivered-To: 6tisch-security@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14BD3129554; Sun, 13 Nov 2016 23:18:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fwNaCmuEv6jo; Sun, 13 Nov 2016 23:18:08 -0800 (PST)
Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7075129420; Sun, 13 Nov 2016 23:18:07 -0800 (PST)
Received: from dooku.sandelman.ca (s2001067c037001280a1196fffe0181e0.v6.meeting.ietf.org [IPv6:2001:67c:370:128:a11:96ff:fe01:81e0]) by relay.sandelman.ca (Postfix) with ESMTPS id 3EE371F8EE; Mon, 14 Nov 2016 07:18:06 +0000 (UTC)
Received: by dooku.sandelman.ca (Postfix, from userid 179) id C459F28A4; Mon, 14 Nov 2016 02:18:02 -0500 (EST)
From: Michael Richardson <mcr+ietf@sandelman.ca>
to: 6tisch-security <6tisch-security@ietf.org>, anima-bootstrap <anima-bootstrap@ietf.org>
In-reply-to: <efb2a1b9-a5b2-9e38-abd5-1c8031d9f1cd@gmail.com>
References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> <24910.1479078501@dooku.sandelman.ca> <efb2a1b9-a5b2-9e38-abd5-1c8031d9f1cd@gmail.com>
Comments: In-reply-to Brian E Carpenter <brian.e.carpenter@gmail.com> message dated "Mon, 14 Nov 2016 13:06:33 +1300."
X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha1"; protocol="application/pgp-signature"
Date: Mon, 14 Nov 2016 16:18:02 +0900
Message-ID: <5562.1479107882@dooku.sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/6tisch-security/i5Z0HLGpYM1Ov6Y-YIaemx_hMOY>
Cc: Brian E Carpenter <brian.e.carpenter@gmail.com>
Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted
X-BeenThere: 6tisch-security@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/6tisch-security>, <mailto:6tisch-security-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/6tisch-security/>
List-Post: <mailto:6tisch-security@ietf.org>
List-Help: <mailto:6tisch-security-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/6tisch-security>, <mailto:6tisch-security-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Nov 2016 07:18:09 -0000

Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
    >> > 3. Mini-question, is this really IPv6-specific? If not I'd prefer a
    >> > name that flags it as an AN infrastructure objective, e.g. "AN_Join"
    >>
    >> okay.  The problem in 6tisch for proxy<->registrar communication
    >> (admission control) is the TCP stack required.

    > Right. I've been assuming that a "BRSKI-COAP" method is available, and
    > if we use GRASP Flood, no TCP is needed at the pledge side.

BRSKI-CoAP lets us do the *ENROLLMENT* over CoAP, not the discovery.

These are the interactions, and I will try to give some names to the various
interactions in a future document, but suggestions most welcome.

1) pledge <-> Join Assistant (JA)
   Discovery of JA:   mDNS and/or M_FLOOD

2) Join Assistant *discovery* of Registrar
   in 6tisch, omitted, will be provisioned
   in ANIMA, uses GRASP M_DISCOVERY

3) Join Assistant tentative admission control (used in 6tisch, to provide
   {optional?} "move along" feedback.).
   6tisch, currently M_REQ_NEG/M_END over *TCP*, need to be fixed.

4) pledge <-> Registrar.
   in ANIMA, this is pledge---TCP/HTTPS---> Registrar (RFC7030)
   in 6tisch-zero-touch, this is Registrar ---CoAP/DTLS--> pledge [maybe EDHOC]
                   (CoMI: draft-ietf-netconf-keystore-00 )
   in 6tisch-minimal-security, this is pledge-->CoAP/EDHOC--> Registrar



--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-

v2.23.0 | Report a Bug | By Email