Re: [Ace] Summary of ACE Group Communication Security Discussion

Göran Selander <> Fri, 18 November 2016 08:00 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 934491294C1 for <>; Fri, 18 Nov 2016 00:00:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.22
X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ruxprjk3tkU4 for <>; Fri, 18 Nov 2016 00:00:20 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 2E1FD1294AE for <>; Fri, 18 Nov 2016 00:00:19 -0800 (PST)
X-AuditID: c1b4fb3a-21fff70000005ff3-c4-582eb50f8007
Received: from (Unknown_Domain []) by (Symantec Mail Security) with SMTP id 11.67.24563.F05BE285; Fri, 18 Nov 2016 09:00:17 +0100 (CET)
Received: from ([]) by ([]) with mapi id 14.03.0319.002; Fri, 18 Nov 2016 09:00:15 +0100
From: Göran Selander <>
To: Kathleen Moriarty <>, "" <>
Thread-Topic: [Ace] Summary of ACE Group Communication Security Discussion
Date: Fri, 18 Nov 2016 08:00:15 +0000
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_D45466986D02Fgoranselanderericssoncom_"
MIME-Version: 1.0
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrDIsWRmVeSWpSXmKPExsUyM2K7rq7gVr0Ig/4fihbfv/UwWzTszLfo OdTPbjFlXZbF6hvPWSxO7N7G6MDmMeX3RlaPyY/nMHrsnHWX3WPJkp9MHi1z9jAHsEZx2aSk 5mSWpRbp2yVwZRz/vZO9YPlMpopb3xcwNzB+mcjUxcjJISFgIvH3bxtrFyMXh5DAOkaJ9Yc3 s0A4Sxgl+hsaGEGq2ARcJB40PALrEBGIlNg0rZ8RpIhZYDOjxKZbT1hAEsICnhLb961mhyjy krh1ZxNbFyMHkF0nsepeIUiYRUBV4kLHW2aQMK+AhUTX5lKIXb2sEtNfbAVr5RQIlJiyexMr iM0oICbx/dQasL3MAuISt57Mh7paQGLJnvPMELaoxMvH/1hBZooK6EmsuR8GEVaSWLH9EiNI mFkgVqJzky1ImFdAUOLkzCcsExhFZyEZOguhahaSKoiwpsT6XfoQ1YoSU7ofskPYGhKtc+ZC 2dYSC3d9ZEJWs4CRYxWjaHFqcXFuupGRXmpRZnJxcX6eXl5qySZGYBwf3PLbagfjweeOhxgF OBiVeHgN/ulGCLEmlhVX5h5ilOBgVhLh3bROL0KINyWxsiq1KD++qDQntfgQozQHi5I4r9nK ++FCAumJJanZqakFqUUwWSYOTqkGRu9XNWbJdeeYZD3P/1g5uc9laYbj5W8zjf49Ei6Yx1Bi qGMXIF64pNwlVmBCR1zmFpvrT5fvqFT4JzONtecy4x3v1XXFkz+4nnuVrPz2zO+m08fln8VF HimvXnRZTkf/vLXlmxhR/dDJdbc/3dnns81nrXyP0NvnbLbSity9XVV/WJPFTx3Zo8RSnJFo qMVcVJwIAPeqLz3fAgAA
Archived-At: <>
Cc: Michael Richardson <>, Michael StJohns <>, Rene Struik <>, "Tirumaleswar Reddy (tireddy)" <>
Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 18 Nov 2016 08:00:27 -0000

Kathleen and all,

I believe all necessary drafts for a solution based on asymmetric keys are already in place.

With "a solution based on asymmetric keys” I understand a solution where each member of the group can sign messages with its private key for source authentication but where confidentiality is protected with a symmetric key shared between the members of the group.

[1] describes how to distribute and use symmetric keys, using a KDC for distributing the symmetric keys, and references OSCOAP for securing the group communication. [2] shows how to secure group communication for CoAP based on asymmetric keys as described above. As far as I understand, the only thing missing is a mechanism for distributing the public keys of the members, but it seems natural to extend the KDC with this functionality.


However, I don’t agree with all conclusions of the asymmetric key proponents.

It is not news that asymmetric key techniques are feasible for use in many embedded device applications, but it is good that the knowledge is being spread. But execution times and message sizes may still be prohibitive for some applications. To address Rene’s question "is 64B too much?": Adding the countersignature to COSE messages such as those used in multicast OSCOAP would increase the size from the order of 20 bytes to the order of 85-90 bytes which in turn may add significant latency depending on link layer technology used, independently of processor capacity.

Without neglecting the issues raised, I do think that there is a role for symmetric key based group communication for the class of actuators in scope of [1]. I agree it is an issue if compromising one device and extracting one key let's you turn off 1000 lamps (not saying it has to, but just as an example). But that doesn't automatically turn the lightbulbs into bots.  The security considerations in this case should e.g. include things like restricting capabilities associated with the possession of a shared key.

Independent of this discussion, symmetric key solutions for these use cases will continue to be deployed. I fear we may create greater damage by not analysing and providing guidance to these use cases when applied in a symmetric key setting, at the same time as specifying an asymmetric key solution.


From: Ace <<>> on behalf of Kathleen Moriarty <<>>
Date: Friday 18 November 2016 at 04:59
To: "Tirumaleswar Reddy (tireddy)" <<>>
Cc: Michael StJohns <<>>, Rene Struik <<>>, "<>" <<>>
Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion

On Thu, Nov 17, 2016 at 10:56 PM, Tirumaleswar Reddy (tireddy) <<>> wrote:

I will put up a proposal before the Chicago meeting.

Thank you.


From: Ace [<>] On Behalf Of<>
Sent: Friday, November 18, 2016 5:30 AM
To: Rene Struik <<>>
Cc: Michael StJohns <<>>;<>
Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion

Is anyone willing to work on a draft to be ready in advance of the Chicago meeting so we have a concrete proposal for asymmetric keys?


Please excuse typos, sent from handheld device

On Nov 17, 2016, at 11:26 PM, Rene Struik <<>> wrote:
Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies.
Please see my email to the list of July 26, 2016:
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016:

This seems to take the time latency argument away. The only other technical hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see

So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:
On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all,

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

·       The solution needs to define both, symmetric and an asymmetric group key solution.

There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".

Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.

·       The security consideration section needs to explain under what circumstances what solution is appropriate.

Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices.   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.


If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!


Ace mailing list<>


Ace mailing list<>


email:<> | Skype: rstruik

cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
Ace mailing list<>


Best regards,