Re: [6tisch] [6tisch-security] proposed security text for architecture draft

[Rafa Marin Lopez <[e-mail]>]

Hi Yoshi:

I think this is a reasonable architecture for security, which would cover several important use cases in my opinion. Some comments inline...

El 14/11/2014, a las 10:50, <[e-mail]> <[e-mail]> escribió:

> Here is main PANA use:
> 
> 1. Creating a PANA SA (based on EAP MSK) between JCE and JN where JCE is PAA, JN is PaC, and JA is PANA relay.
> (PANA relay is a stateless relay as described in RFC 6345, and no need for loose source routing or ULA allocation.)
> 
> 2. Using the SA to securely distribute locally significant credentials such as a 802.11AR LDevID certificate or a network-wide shared symmetric key, and I am not in favor of the latter though :) 
> 
> For 1), existing RADIUS servers can be used if EAP server is a physically separated from PCE box where scalability is needed.  EAP-based approach can also support roaming cases where electric vehicles are authenticated via smart meters.

Not only RADIUS but also Diameter which is, by the way, widely used to support many users in 3G,4G networks.

> 
> For 2) we can define new PANA attributes to carry RFC 4210 CertRequest and CertResponse defined by PKIX for distributing 802.11AR LDevID certificate.

+1 

> 
> I did not think to use PANA to carry CoAP messages. I think DTLS should be used for protecting CoAP for 6top as being discussed.  The DTLS session for CoAP can be established, e.g., by using the locally significant credentials distributed in 2).

Perhaps for very small deployments a pre-installed PSK could be used for DTLS (as happens with WPA2-PSK) but certainly it is not scalable.

> 
> Support for UIM card (via EAP-SIM, EAP-AKA or a new EAP method) would make 6tisch more attractive to cover  certain business scenarios.

This is related with my comment about 3g,4g networks.
> 
> Please note that I do not disagree with DTLS-based approach for more resource constrained device (although more work seems to be needed to carry DTLS message between JCE and JN via JA), but we should support multiple options if one solution is difficult to cover all cases.

+1

Best Regards.

>  
> 
> Best Regards,
> Yoshihiro Ohba
> 
> 
> -----Original Message-----
> From: 6tisch-security [mailto:[e-mail]] On Behalf Of Michael Richardson
> Sent: Friday, November 14, 2014 3:12 PM
> To: ohba yoshihiro(大場 義洋 ○ＲＤＣ□ＮＳＬ)
> Cc: [e-mail]; [e-mail]
> Subject: Re: [6tisch-security] [6tisch] proposed security text for architecture draft
> 
> 
> <[e-mail]> wrote:
>> Use of EAP-TLS and terminating TLS session at AAA server does not mean
>> that all parameters have to be coming from AAA server.  Especially when
>> PANA is used, PAA can be co-located with JCE and provide 6top data over
>> a secure PANA SA.  Actually this model applies to any EAP method.
> 
> So, we would be creating a masterkey with EAP-TLS, and then we would use PANA as a transport for CoAP?
> 
> I understand why we want to use EAP when we have devices with humans at the far end;
> 1) it means the pieces in the middle do not need to know anything about the
>   kind of authentication will be done
> 
> 2) we can deploy new forms of authentication (such as challenge response
>   methods, and things like EAP-SIM or EAP-AKA) without changes to the middle
>   machines.
> 
> 3) we can proxy things all the way back to the users home service, which is 
>   how GSM roaming works these days.
> 
> I'm unaware that industrial/deterministic uses of 15.4 have requirements for ths kind of thing.  I seem to recall a conversation about whether or not including a SIM card into nodes would work from a power, size, and cost point of view.  Having a replaceable SIM card would definitely be a really easy way to imprint new devices.  If someone can do that, then we really don't need any of this... 
> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works  -= IPv6 IoT consulting =-
> 
> 
> 
> _______________________________________________
> 6tisch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/6tisch

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: [phone] Fax: [phone] e-mail: [e-mail]
-------------------------------------------------------