[Ace] Clarifications on the pub-sub keying draft

Jim Schaad <ietf@augustcellars.com> Wed, 20 November 2019 00:10 UTC

From: Jim Schaad <ietf@augustcellars.com>
To: ace@ietf.org
CC: 'Benjamin Kaduk' <kaduk@mit.edu>
Date: Wed, 20 Nov 2019 08:10:21 +0800
Message-ID: <01bc01d59f36$e82fe140$b88fa3c0$@augustcellars.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AdWfMwvaSrluI+zAS+ONGsRDg3Lxcw==
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/FdydrSQi0A8Fy9r5NQ6XDsjKl3k>
Subject: [Ace] Clarifications on the pub-sub keying draft
Precedence: list

For those people who were on Jabber yesterday during the meeting, I made a
characterization of Francesca's Pub-Sub draft which was wrong, and she did
not tell me I was an idiot like she should have.

When you are doing encrypted pub-sub there are three problems that need to
be addressed:

1.  Get permissions to talk to the pub-sub server itself.  This is currently
covered by the MQTT draft and the two ACE profiles currently in last call.
In some cases this can also be a NOP.

2.  Get the group encryption keys from the Group KDC:  This is a completely
independent operation from that in step 1.  This is the first halve of the
pub-sub draft.  On jabber I was getting this mixed up with problem 1 and I
should have known better.

3.  How to encrypt the content:  This is the second halve of the pub-sub
draft.

As noted above, problem 1 is completely separate from problems 2 and 3.   It
is for this reason that I do not believe that any part of the pub-sub draft
needs to be included in the MQTT draft.  There might be a forward reference
from MQTT to this draft for content encryption processing but that should be
all that is needed.

Jim

[Ace] Clarifications on the pub-sub keying draft Jim Schaad