Re: [Ace] Adoption of Low Latency Group Communication Security Work in ACE

[Thomas Hardjono <[e-mail]>]

Generally I'm in support of any efforts to secure multicast messaging for IoT 
applications However, I have some concerns about the ACE WG:

(a) Mixing authorization with key management: authorization and key-management 
are separate functions, so they need separate specs.


(b) Application-independent key management: a good key management protocol 
should be deployable for a reasonably broad set of applications area 
(including Consumer IoT and Industrial IoT).

So while its useful to have a solution for lighting application, it remains to 
be seen if the solution works for other applications.


(c) ACE WG work-pace:  The ACE use-cases document took over a year to finish, 
with numerous argumentative & boring emails (I'm not going to name names). 
Sigh. If it takes over 1 year just to agree on use-cases, I can't imagine how 
long it will take to complete an IoT secure multicast key management protocol. 
Double sigh.


(d) Reinventing stuff:  The IETF did have a secure multicast WG that produced 
a lot of drafts and some RFCs, notably RFC 3740 and RFC3547 (RFC6407). There's 
product out there implementing these already.

There's also a draft in DICE on multicast for DTLS (not sure what happened to 
it).

There is the Fluffy draft, but so far the ACE WG has not been very interested 
in it.


(e) Re-chartering:  Will the ACE WG need rechartering and how long.



/thomas/




------------------------------------------


>>> -----Original Message-----
>>> From: Ace [mailto:[e-mail]] On Behalf Of Hannes Tschofenig
>>> Sent: Wednesday, July 20, 2016 6:07 AM
>>> To: [e-mail]
>>> Subject: [Ace] Adoption of Low Latency Group Communication Security Work 
>>> in
>>> ACE
>>>
>>> Hi all,
>>>
>>> at the ACE meeting today I asked the participants whether they are in 
>>> favor
>>> of adding low latency group communication security work in the ACE group.
>>>
>>> 20 persons were in favor of doing the work.
>>>
>>> 5 people argued against doing this work.
>>>
>>> If you haven't been at the meeting please contribute your thoughts here on
>>> the list. If you believe you do not have enough information please also
>>> speak up.
>>>
>>> Ciao
>>> Hannes