Re: [6tisch] Benjamin Kaduk's Discuss on draft-ietf-6tisch-minimal-security-13: (with DISCUSS and COMMENT)

[Michael Richardson <[e-mail]>]

Benjamin Kaduk <[e-mail]> wrote:
    > To be clear, the paragraph I commented upon was:

    > When sending frames during the join process, the pledge sends
    > unencrypted and unauthenticated frames.  The JP accepts these
    > unsecured frames for the duration of the join process.  This behavior
    > may be implemented by setting the "secExempt" attribute in the IEEE
    > Std 802.15.4 security configuration tables.  How the JP learns
    > whether the join process is ongoing is out of scope of this
    > specification.

    > I'd suggest a rewording/clarification to:

    > NEW:
    > When sending frames during the join process, the pledge sends
    > unencrypted and unauthenticated frames.  In order for the join process
    > to be possible, the JP must accept these unsecured frames for the
    > duration of the join process.  This behavior may be implemented by
    > setting the "secExempt" attribute in the IEEE Std 802.15.4 security
    > configuration tables.  It is expected that the lower layer provides an
    > interface to indicate to the upper layer that unsecured frames are being
    > received from a device, and that the upper layer can use that information
    > to make a determination that a join process is in place and the unsecured
    > frames should be processed.  How the JP makes such a determination and
    > interacts with the lower layer is out of scope of this specification.

I've used your changed text.
I believe that we had a discussion about the presence of the interface that
you reference. I believe that this is not mandated by older IEEE 802.15.4
API specifications.  However, many OSes (Contiki,RIOTOS,OpenWSN...) do not
actually use the IEEE APIs, so this limitation is not generally a problem.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-