Re: [Ace] Scope of the ACE Charter

[Göran Selander <[e-mail]>]

Hi Hannes,


Just looking at interface (I): If the client is not constrained I think
HTTP/TLS should be an option to COAP/DTLS.

Adding to the discussion about HTTP/COAP proxies in the meeting: If both
the authorisation information and the keying information is object secure
(JWT, CMS, Š) there is no need to trust the proxy.



Göran




On 05/03/14 14:32, "Hannes Tschofenig" <[e-mail]> wrote:

>Hi all,
>
>I would like to thank you all for the great discussion today at the BOF.
>There was good feedback and the following scoping aspect showed up.
>
>In a nutshell there was some disagreement to purely focus on CoAP/DTLS
>as part of a future working group.
>
>There was not enough time to go down to the details during the session
>due to lack of time. Hence, I will try to clarify this aspect on the
>mailing list.
>
>Let us have a look at the high level architecture:
>
>                                          +---------------+
>                                          | Authorization |
>             +--------------------------->|  Server       |
>             |        (I)                 +---------------+
>             |                                  ^
>             |                                  |
>             |                                  |
>             |                                  | III
>             |                                  |
>             |                                  |
>             |                                  |
>             v                                  v
>        +-----------+                     +-----+-----+
>        |           |      II             | Resource  |
>        |   Client  | <..................>| Server    |
>        +-----------+                     +-----------+
>
>I: This is the interaction where keying and authorization information is
>provided to the client.
>
>II: This is the resource access.
>
>III: This is a potential exchange necessary for having the resource
>server interacting with the authorization server for authenticating the
>client and for authorizing the client.
>
>(The exact details of the interaction depend on the specific solution,
>of course.)
>
>As you can see in the figure, there are various places where DTLS and
>CoAP should or shouldn't be used.
>
>A few persons said that they want to use other protocols besides CoAP
>and DTLS.
>
>Please explain me where you would like to other protocols being taken
>into consideration. What protocols are you considering in which of these
>interfaces?
>
>Ciao
>Hannes
>