Re: [6tisch-security] slides you presented

[Göran Selander <[e-mail]>]

Hi Michael,

On 2017-02-24 14:31, "Michael Richardson" <[e-mail]> wrote:

>
>peter van der Stok <[e-mail]> wrote:
>    > Let me ask very high-level questions about the presented slides.  Is
>    > the diffie-hellman part a replay of the EDHOC draft? or an optimized
>    > extension, or completely new?  Is the SK part an OSCOAP scenario?
>
>It's EDHOC.  This is all OSCOAP.
>
>    > Will the use of CoMI be described in the minimal security draft?
>
>Ugh. There seems to be much resistance to doing that.
>I am preparing text to say two things, and I need help with the second
>part.
>
>Part 1) saying that rekey is out of scope.
>
>Part 2) explaining how to use the exchange to key additional OSCOAP
>     channels.
>
>Originally, I was going to point to rfc5295, until I realized that HKDF
>was
>embedded in things already, no point in going further.
>
>Goran, is there some way to specify that one runs section 6 (Derive
>Traffic
>Secret) with different inputs to get additional traffic secrets for
>additional applications?

Yes, this is straightforward in the latest version on the Github:
https://ericssonresearch.github.io/EDHOC/


Section 3.2 describes the key derivation and allows the definition of an
application specific label (byte string) which is used to derive an
application specific key from the key established through the run of EDHOC.

How this is used to derive the OSCOAP master secret/salt you find in
appendix B.2. 

>
>Could COSE_KDF_Context include one final, optional element, which might be
>called "subapplication_name"?  I'm not sure if that belongs after
>SuppPubInfo, or within it.

I guess the label above would be sufficient, right?

>
>We *could* just continue to use the traffic secret derived for
>6tisch-minimal, but that seems too intricately linked from a specification
>point of view. 

Different applications should use different keys, so you should define
different labels and then be able to derive the keys as indicated above.

> (I notice that OSCOAP totally supports using the same keys
>with a CoAP client/server role reversal)

Yes, but there are different keys in different directions. So one node
will use the same key for sending, independently of it is client and
sending a request or server sending a response (different IVs are used
each time), and, analogously, one key for receiving.

Hope that helps.

Göran


>
>--
>]               Never tell me the odds!                 | ipv6 mesh
>networks [
>]   Michael Richardson, Sandelman Software Works        | network
>architect  [
>]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails
>   [
>