Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?)

[Dan Garcia <[e-mail]>]

Hi Benjamin,

Thank you for your suggestion. Your comment is relevant.

In fact, we wrote some time ago an article regarding our initial design, 
and we perform a comparison with other network layer based EAP 
lower-layer (https://www.mdpi.com/1424-8220/16/3/358)

We compared focusing EAP lower-layer (alone) and taking into account 
EAP. On the one hand, at EAP lower-layer level, the usage of CoAP gives 
us an important benefits. On the other hand, when taking into account 
the EAP method overload, this reduction is less but still significant if 
the EAP method is lightweight (we used EAP-PSK as a representative 
example of a lightweight EAP method). As you suggest, if the EAP method 
is very taxing (as the case you mentioned) the improvement carried out 
in the EAP lower-layer is less significant. This leads to the conclusion 
that possible next steps in this field could be also improving or 
designing new EAP methods that can be better adapted to the requirements 
of constrained devices and networks. However, we cannot ignore the 
impact of the EAP lower-layer itself and try to propose something light 
as we do proposing CoAP.

We consider that may be others EAP methods such as EAP-AKA or new 
lightweight EAP methods such as EAP-EDHOC 
(https://tools.ietf.org/html/draft-ingles-eap-edhoc-01) that can benefit 
from a CoAP-based EAP lower-layer, as well as new ones that may be 
proposed in the future with IoT constraints in mind.

Best Regards,
Dan.

El 12/1/21 a las 20:05, Benjamin Kaduk escribió:
> Hi Dan,
>
> Sorry to reply to such an old message...
>
> On Sat, Dec 12, 2020 at 06:36:53PM +0100, Dan Garcia Carrillo wrote:
>> Hi Mališa,
>>
>>
>> El 11/12/2020 a las 19:45, Mališa Vučinić escribió:
>>> Hi Dan,
>>>
>>> Thanks for the clarification regarding minimal-security. The points
>>> that you mention below, e.g. flexible authentication or the fresh
>>> generation of the PSK, were never in the design scope of our work.
>>>
>>> While I fail to understand what exactly do you plan on using
>>> EAP-over-CoAP for, I do not object on this work being done in ACE if
>>> you are willing to spend cycles on it. I do have reservations on the
>>> lightweight aspect of this, however, considering that the sequence
>>> diagram that you depict in Fig. 2 in draft-marin-ace-wg-coap-eap-06
>>> spans 3 pages and consumes 2 round trips just to get things started!
>>> Surely, we can do better?
>>>
>> Yes, we will submit an updated version of the draft.
> When you do, I suggest putting in some discussion of the relative
> size/overhead for CoAP as EAP lower-layer vs the EAP payloads themselves.
> I note that the IESG recently approved draft-ietf-emu-eaptlscert that
> discusses some pathological cases with TLS-based EAP methods and very large
> certificate chains.  While I assume that you're not planning to do
> EAP-over-CoAP with such long TLS certificate chains, giving reviewers a
> sense for how big of an improvement this mechanism can be will presumably
> be helpful.
>
> Thanks,
>
> Ben