[6tsch] FW: draft-ohba-6tsch-security-00

["Pascal Thubert (pthubert)" <[e-mail]>]

Dear all:

I realized that the list was not copied; fixing this now. The discussion is around section 2 that is missing the expansion of 6TSCH

Cheers,

Pascal

From: [e-mail] [mailto:[e-mail]]
Sent: mardi 25 juin 2013 11:04
To: Pascal Thubert (pthubert); [e-mail]; [e-mail]
Cc: [e-mail]
Subject: RE: [6tsch] draft-ohba-6tsch-security-00



From: Pascal Thubert (pthubert) [mailto:[e-mail]]
Sent: Tuesday, June 25, 2013 5:46 PM
To: [e-mail]<mailto:[e-mail]>; ohba yoshihiro(大場 義洋 ○ＲＤＣ□ＮＳＬ); [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>
Subject: RE: [6tsch] draft-ohba-6tsch-security-00

Hello Xavi and Yoshi.

I’d agree that our terminology is not perfect for that definition. Let us discuss this at the next call.
“
  6TSCH:      Entity that sets up the schedule, controls the
               connectivity graph of the network, and the resources
               allocated to each scheduled cell in that connectivity
               graph.  It may be an adaptation layer, a distributed
               reservation protocol, a centralized path computation
               entity, or any combination thereof.

“
I think that the definition should 1) spell out the acronym “IPv6 over Time Slotted Channel Hopping”, and 2) explain that 6TSCH defines a set of IETF sublayers and protocols, as well as an architecture to bind them together, for use in TSCH based networks. Which in turns reminds me that people are getting confused when we tell them that 6TSCH pronounces “SIXTUS” and that we also have a sublayer called 6TUS. Shouldn’t we change something there?

Yoshi:  I think section 2 should refer to our terminology. There is already a XREF link at the end of the draft. If the terminology expands the acronym for 6TSCH you’re all set : )
[YO] As soon as we agree on the acronym for 6TSCH I will put it in section 2.

About section 3. Could we separate the commissioning from the bootstrapping? I would like to see a phase 0 when the device is prepared and the management systems are provisioned. In particular: What are the expectation on the device off the factory: Some builtin vendor crypto material / certificate? And then when the device is acquired and prepared for installation: Should the OT people configure an IPv6 address? Additional crypto material like a shared secret?

[YO] We could add text for phase 0 for commissioning (I think Figure 1 can still start with phase 1 since phase 0 does not need to be standardized).  The purpose of phase 0 is to install phase 1 KMP credentials in a physically secured and managed location before the devices are placed where they are expected to operate.

Regards,
Yoshihiro Ohba


Cheers,

Pascal