[Ace] Coordinated effort to produce updated profiles for the use of crypto algorithms in IoT
John Mattsson <john.mattsson@ericsson.com> Mon, 19 March 2018 11:11 UTC
Return-Path: <john.mattsson@ericsson.com>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D7B81200B9 for <ace@ietfa.amsl.com>; Mon, 19 Mar 2018 04:11:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.32
X-Spam-Level:
X-Spam-Status: No, score=-4.32 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=GmTWilh9; dkim=pass (1024-bit key) header.d=ericsson.com header.b=NL4PBpOV
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P6qg5jVDAwn4 for <ace@ietfa.amsl.com>; Mon, 19 Mar 2018 04:11:24 -0700 (PDT)
Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2615312D777 for <ace@ietf.org>; Mon, 19 Mar 2018 04:11:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1521457882; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=3n1gtKr2iR/G/bjeRB71pN0WIixWXaFP+kbPJzu2zEY=; b=GmTWilh9LZt/Bynv5Cq2hftulPc3SzKj0j9ES5fjpyjrsGnhbEVTCLqCjsoyFJ9y UapnxSQXIwlzZUDJ0RaYO+q5HfknmS+fKhGvCTU9vWgj5AsiOdRFdSaeIUsGkJyc pN/uBN3ip9ROPtdejfd+s5G+UPgaKtQT7dgDBXnzGYU=;
X-AuditID: c1b4fb2d-499ff70000005540-13-5aaf9ada9df6
Received: from ESESSHC002.ericsson.se (Unknown_Domain [153.88.183.24]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 51.1E.21824.ADA9FAA5; Mon, 19 Mar 2018 12:11:22 +0100 (CET)
Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESSHC002.ericsson.se (153.88.183.24) with Microsoft SMTP Server (TLS) id 14.3.382.0; Mon, 19 Mar 2018 12:11:21 +0100
Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1034.26; Mon, 19 Mar 2018 12:11:21 +0100
Received: from EUR02-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1034.26 via Frontend Transport; Mon, 19 Mar 2018 12:11:21 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=3n1gtKr2iR/G/bjeRB71pN0WIixWXaFP+kbPJzu2zEY=; b=NL4PBpOV6wMWyu95tb+xy83MXsAOSJ5kpYIzSATt4KGo4D6oS8p9tmwM2I0ONPs+oalDAObMbNLkSNl3keD1rGuj8hUiOq8xc8PEVJA3URL92yXd9NbsA2P2ztiuKKKZVezeudB0uo3AUB4EtoQjtxWn77cSoYrsgBMLtKt+cIg=
Received: from HE1PR0701MB2011.eurprd07.prod.outlook.com (10.167.189.149) by HE1PR0701MB2793.eurprd07.prod.outlook.com (10.168.189.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.609.6; Mon, 19 Mar 2018 11:11:20 +0000
Received: from HE1PR0701MB2011.eurprd07.prod.outlook.com ([fe80::7d80:1860:283c:5ef2]) by HE1PR0701MB2011.eurprd07.prod.outlook.com ([fe80::7d80:1860:283c:5ef2%3]) with mapi id 15.20.0609.007; Mon, 19 Mar 2018 11:11:20 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: "ace@ietf.org" <ace@ietf.org>
Thread-Topic: Coordinated effort to produce updated profiles for the use of crypto algorithms in IoT
Thread-Index: AQHTv3MCif9BXYu3HkOEVFgP17NpKw==
Date: Mon, 19 Mar 2018 11:11:20 +0000
Message-ID: <2271DDAC-77A5-4B82-A4A7-5B48CBEC2321@ericsson.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.a.0.180210
x-originating-ip: [2001:67c:370:1998:acc7:80df:c647:d84b]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2793; 7:LhajbCRuuF2s10B36ROESLly0jdMw6mDiAprENuNG//vVzCGbmwIRkWNm6ol5ehVTDuJfH7KakplwIxMFinToFAc2Bt0GeMrKK6yvKtWgXUd1KfyB7LAF+db8k41lY+w5X1QZTb9Dk7EFkSvTI9EmKfraL2o0BiV+Lzc+jJXtjJY07RFLlummV2UjGNS/TmSIPikfdZbKZkDUtEcgZaIwCqXSUjA20qJX9zzpdiIhs5NLdgj9/lqfJjLdKMHIApr
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 7a450513-1429-4d3c-2a3b-08d58d8a24af
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:HE1PR0701MB2793;
x-ms-traffictypediagnostic: HE1PR0701MB2793:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com;
x-microsoft-antispam-prvs: <HE1PR0701MB27938BCCF0C0788F0F75ABDF89D40@HE1PR0701MB2793.eurprd07.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(28532068793085)(192374486261705)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3231221)(944501300)(52105095)(3002001)(93006095)(93001095)(10201501046)(6041310)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:HE1PR0701MB2793; BCL:0; PCL:0; RULEID:; SRVR:HE1PR0701MB2793;
x-forefront-prvs: 06167FAD59
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39380400002)(366004)(396003)(39860400002)(376002)(346002)(199004)(189003)(86362001)(5250100002)(83716003)(316002)(6116002)(59450400001)(186003)(6436002)(7736002)(46003)(5660300001)(2501003)(14454004)(8936002)(2900100001)(97736004)(7110500001)(82746002)(1730700003)(8676002)(81156014)(99286004)(81166006)(68736007)(25786009)(6512007)(6306002)(2351001)(3280700002)(3660700001)(6506007)(36756003)(6916009)(54896002)(478600001)(6486002)(58126008)(106356001)(2906002)(33656002)(53936002)(105586002)(10710500007)(102836004)(5640700003)(15650500001)(2420400007); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2793; H:HE1PR0701MB2011.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: +Plu0wzisscD8lYUlB05nNblb59ga0fb9itiItdlCKXT7igp1sX5Ie85jTwJiXyozXkYkMZF5c6bmVU/0aL9egswT5/AI2v9gcQ58kvCwGZlXYNz+teenOMLXPsbdZYS1xolxTpkUb6Zy3Z6d6OX8MjTqOTAQaLYmTE/MZVuS69j8FsIBb3yba8nInfuo7v99sGkYolD88OrTB93T54j8JN61+eYSgX2JCkOFDcQPXVOmWzwBgEQSCuKmBg6pk3vjIxNPsZbestkAychGtSGMFJT8VISaU/eOuILS7+NvNbWKgY65fm8GObSwcEzMyFnMZrqHdg4a/plvF5u/SGEAQ==
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_2271DDAC77A54B82A4A75B48CBEC2321ericssoncom_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 7a450513-1429-4d3c-2a3b-08d58d8a24af
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Mar 2018 11:11:20.2943 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2793
X-OriginatorOrg: ericsson.com
X-Brightmail-Tracker: H4sIAAAAAAAAA02SfUhTURjGOffezetqdVwuX7QSh0KZTq0ELSn7I1Is6k+Z9HHRq87U2b1m ahiDXIZfmTjSpVm5ZV/TMjGLRaUpaVR+VIJZYn5h4gcmmSbWtrvA/37P8z7n5TyHQ5OyWpE7 rU5NZ7lUJlkhllAV0U/Av99QrwocqPAMWfhVSIajCKNxkTiKVJKwODZZncFyAXtPShIf9ZaK 04ojM6fmcwktyjuYj5xpwLugtvglaWMZbkWgu7gnH0ms3IhAW3qHEMQCgqLBMocwEdB6vZmy CQrPEVBmfO8kTPQELJkbkSDGEJRPzBG2zWIcCFUWrTgf0bQr9oK+74zN3oAZeDrTKBLsePjb pbLZrlgJXbMP7Scp7AP6cR2ysRTvgxVzlZ0R3ggLnQ/sGRK7Qf9INSH0wWC0fCAFlsPE8IrI xnLrzgtzfU6CHwrdhWNI4M3QU13g4CYCWqa3C+wPs3q9Y89huFaSSwncieBWebDAflAzuey4 zzHQ6a7aqwDWwKA2R4jEQMPv1/YXAXyXhDeTX8TCYBOUP74sKkFKw6oKButxEsdC70CSwd7Y BToqRijB3gb1zwKEtBeUFQw5CbwVdJVVDo6A5U/DaHXmBqLvITnP8nxKwo6dSpZTx/K8JlWZ yqY3IOv3edX4x78Z3Z/c34IwjRRrpc5X6lUyEZPBZ6W0IKBJhat09GOdSiaNY7KyWU5zgjuT zPItyIOmFG7SjkipSoYTmHT2FMumsdz/KUE7u2vRTVNKzgKnzLx0ur3CU3P2BactnH8H0VpT kE/pt+MHnDUxbW9/iBddLOUmi5/yeXsRWdn9syd0KsosqYtCu9Ul1cHxXwfC+gMM7tkecm8R d2SNb15PbGbaIdV5KnepwIJrxkOGh2aoz0neSevNt41N63KmQ9piwkfPicPd2S0Kik9kgnxJ jmf+Ac1eObI6AwAA
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/30H034C9lk7ydkiGqbGO9NXjTcs>
Subject: [Ace] Coordinated effort to produce updated profiles for the use of crypto algorithms in IoT
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Mar 2018 11:11:28 -0000
I strongly support Carsten’s suggestion to have a coordinated effort to produce updated profiles for the use of crypto algorithms in IoT. I think the work should include at least TLS, DTLS, COSE, and X.509 and take into consideration the hardware acceleration available in (future) devices. Should also look if there is a need to update X.509 profile in RFC 7925, any new IoT profile should be applicable to both TLS and COSE. How do we get this started in a way that applies to all IETF groups using crypto? I would be happy to help with this work. Some quick thoughts: - Curve25519 is already implemented a lot, but needs to be differentiated from Ed25519 which is not implemented as much (yet) and may require CA support for certificate based deployments. Curve25519 and Ed25519 has a strong potential to lower latency, storage, memory, and battery consumptions in IoT devices. There was earlier vendors stating that curves with a cofactor caused problems for older hardware. My understanding is that this has now changed, at least the UICC vendors in 3GPP has stated that curve25519 works on their current hardware. - ChaCha20-Poly1305 is only standardized with 128-bit tags and therefore not very well suited for IoT. Like GCM, Poly1305 is not very well suited for truncated tags. AES_128_OCB_8 only requires half the amount of AES operations, but AES is not drawing much power compared to transmitting, listening, and receiving radio, so any update from AES_128_CCM_8 might not be worth it. I think 64 bit tags is a good compromised between overhead and security for IoT. - PRF. TLS 1.3 used HMAC with SHA-256, RFC8247 specifies PRF_AES128_XCBC for devices not having SHA. - Hash algorithms, Ed25519 is as far as I known standardized with SHA-512/256. IoT deployments of TLS and DTLS typically use SHA-256. Cheers, John
- [Ace] Coordinated effort to produce updated profi… John Mattsson
- Re: [Ace] Coordinated effort to produce updated p… Hannes Tschofenig
- Re: [Ace] Coordinated effort to produce updated p… Panos Kampanakis (pkampana)