[6tisch-security] Who initiates Phase 2?

Mališa Vučinić <malisa.vucinic@inria.fr> Wed, 30 November 2016 09:28 UTC

From: =?utf-8?Q?Mali=C5=A1a_Vu=C4=8Dini=C4=87?= <malisa.vucinic@inria.fr>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-Id: <F3B7D5FA-D6D5-49B3-9CE7-2C20355A6681@inria.fr>
Date: Wed, 30 Nov 2016 10:24:59 +0100
To: tisch-security <6tisch-security@ietf.org>
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Archived-At: <https://mailarchive.ietf.org/arch/msg/6tisch-security/jQBBB1pg-O1G6SSEKvHTWaALlvA>
Subject: [6tisch-security] Who initiates Phase 2?
Precedence: list

Michael,

Coming back to the discussion on who initiates the exchange in Phase 2 of the join protocol.

My understanding of the IETF 97 meeting outcome is that Phase 1 and Phase 2 will be ran in sequence. Phase 1 runs to completion with manufacturer-installed certificate as the start state and locally-relevant credential as the end state. Phase 2 immediately takes over and uses the locally-relevant credential as the start state and network-wide K2 as the end state. 

In that setup, I don’t really see why it matters who initiates Phase 2. Being it JCE, we end up having a PUT and a response (two messages). Being it JN, we end up with a GET and a response (two messages). Either way, messages are exchanged in a sequence initiated by the party that initiated Phase 1. Matching CoAP’s client/server role to the role in the key agreement protocol is not necessary, I believe. Am I missing something?

Mališa

[6tisch-security] Who initiates Phase 2? Mališa Vučinić