Re: [6tisch] [6tisch-security] proposed security text for architecture draft

Regarding issuing a certificate, we have discussed internally here at UMU that the PAA could certify a public key, which is sent by the PaC/JN through the PANA SA built after a successful PANA authentication  (e.g. a PNR/PNA exchange could be used for that). In this sense, there is no need for a global CA.

Best Regards.

El 17/11/2014, a las 00:36, yoshihiro.ohba@toshiba.co.jp escribió:

> An issued certificate in a CertResponse is signed by a CA trusted by JN, and the CertResponse is protected by the PANA SA.
> 
> The PANA SA is derived from an EAP MSK which is established between EAP peer and EAP server and is transported by EAP server to authenticator, and therefore the PANA SA is attached to the EAP method security.
> 
> Yoshihiro Ohba
> 
> 
> -----Original Message-----
> From: 6tisch-security [mailto:6tisch-security-bounces@ietf.org] On Behalf Of Michael Richardson
> Sent: Sunday, November 16, 2014 1:13 PM
> To: 6tisch@ietf.org; 6tisch-security@ietf.org
> Subject: Re: [6tisch-security] [6tisch] proposed security text for architecture draft
> 
> 
>> For 2) we can define new PANA attributes to carry RFC 4210 CertRequest
>> and CertResponse defined by PKIX for distributing 802.11AR LDevID
>> certificate.
> 
> The EAP-TLS security is between joining node (supplicant) and radius/diameter server (authentication server).  
> 
> The PANA is between the authenticator and the joining node (supplicant). 
> The PANA has no security attached.   
> 
> How can the supplicant know that the CertResponse it is getting is legitimate?
> 
> -- 
> ]               Never tell me the odds!                 | ipv6 mesh networks [ 
> ]   Michael Richardson, Sandelman Software Works        | network architect  [ 
> ]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [ 
> 	
> 
> _______________________________________________
> 6tisch mailing list
> 6tisch@ietf.org
> https://www.ietf.org/mailman/listinfo/6tisch

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------