Re: [6tisch] [6tisch-security] proposed security text for architecture draft

[<[e-mail]>]

Here is main PANA use:

1. Creating a PANA SA (based on EAP MSK) between JCE and JN where JCE is PAA, JN is PaC, and JA is PANA relay.
(PANA relay is a stateless relay as described in RFC 6345, and no need for loose source routing or ULA allocation.)

2. Using the SA to securely distribute locally significant credentials such as a 802.11AR LDevID certificate or a network-wide shared symmetric key, and I am not in favor of the latter though :) 

For 1), existing RADIUS servers can be used if EAP server is a physically separated from PCE box where scalability is needed.  EAP-based approach can also support roaming cases where electric vehicles are authenticated via smart meters.

For 2) we can define new PANA attributes to carry RFC 4210 CertRequest and CertResponse defined by PKIX for distributing 802.11AR LDevID certificate.

I did not think to use PANA to carry CoAP messages. I think DTLS should be used for protecting CoAP for 6top as being discussed.  The DTLS session for CoAP can be established, e.g., by using the locally significant credentials distributed in 2).

Support for UIM card (via EAP-SIM, EAP-AKA or a new EAP method) would make 6tisch more attractive to cover  certain business scenarios.

Please note that I do not disagree with DTLS-based approach for more resource constrained device (although more work seems to be needed to carry DTLS message between JCE and JN via JA), but we should support multiple options if one solution is difficult to cover all cases.  

Best Regards,
Yoshihiro Ohba


-----Original Message-----
From: 6tisch-security [mailto:[e-mail]] On Behalf Of Michael Richardson
Sent: Friday, November 14, 2014 3:12 PM
To: ohba yoshihiro(大場 義洋 ○ＲＤＣ□ＮＳＬ)
Cc: [e-mail]; [e-mail]
Subject: Re: [6tisch-security] [6tisch] proposed security text for architecture draft


<[e-mail]> wrote:
    > Use of EAP-TLS and terminating TLS session at AAA server does not mean
    > that all parameters have to be coming from AAA server.  Especially when
    > PANA is used, PAA can be co-located with JCE and provide 6top data over
    > a secure PANA SA.  Actually this model applies to any EAP method.

So, we would be creating a masterkey with EAP-TLS, and then we would use PANA as a transport for CoAP?

I understand why we want to use EAP when we have devices with humans at the far end;
1) it means the pieces in the middle do not need to know anything about the
   kind of authentication will be done

2) we can deploy new forms of authentication (such as challenge response
   methods, and things like EAP-SIM or EAP-AKA) without changes to the middle
   machines.

3) we can proxy things all the way back to the users home service, which is 
   how GSM roaming works these days.

I'm unaware that industrial/deterministic uses of 15.4 have requirements for ths kind of thing.  I seem to recall a conversation about whether or not including a SIM card into nodes would work from a power, size, and cost point of view.  Having a replaceable SIM card would definitely be a really easy way to imprint new devices.  If someone can do that, then we really don't need any of this... 

--
Michael Richardson <[e-mail]>, Sandelman Software Works  -= IPv6 IoT consulting =-