Re: [Ace] MQTT, OSCORE, DTLS profiles - recommendation on RS - AS communication
Cigdem Sengul <cigdem.sengul@gmail.com> Tue, 13 April 2021 12:44 UTC
Return-Path: <cigdem.sengul@gmail.com>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED31C3A1479 for <ace@ietfa.amsl.com>; Tue, 13 Apr 2021 05:44:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0A-tSqnMF31w for <ace@ietfa.amsl.com>; Tue, 13 Apr 2021 05:44:33 -0700 (PDT)
Received: from mail-ua1-x929.google.com (mail-ua1-x929.google.com [IPv6:2607:f8b0:4864:20::929]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 100D03A1472 for <ace@ietf.org>; Tue, 13 Apr 2021 05:44:32 -0700 (PDT)
Received: by mail-ua1-x929.google.com with SMTP id a8so2157158uan.10 for <ace@ietf.org>; Tue, 13 Apr 2021 05:44:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=deJjms3/BZHZ7TjdTm9kyPHJUcrmSOH58QVQBUhjvTs=; b=lKV2gEXB7dWaO9CtqHc4ii8LlRwEpcKgO6woy9swk9JqDiEKYIBCKLAqQDYw5fjcqQ paY8xWg5gXLasilLfpFJ+ZCv2cAIig5MGt2s8gGHjZL3k50eeEnFw0GkntF658srccBq dsk9GTGpULeVeqkTzxqxXVpYg3IuKMbFcscwP1wzE2EssDhC+KSThNxvM980T9Wysa1e Y55eoaFxoFFIyIx35z6av+ene5wLB/rp4oIVT0uWtAKDGDOhLUiMdLNbFck9RqHug3eC sDnmd6v5G8tR7scFWpUe5dpRhtbfzEk++FtLmsnGIhksnyJfCBDm6WOnZ//knaBMt5Sm 7y4g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=deJjms3/BZHZ7TjdTm9kyPHJUcrmSOH58QVQBUhjvTs=; b=DxQmi8Idkmu+7pMEB8wv7Dnf7EjaMPrcGuFxuJkopVgKs/HDL/OD1mB3ohRGOFj8Te m03sKBe2SUJ1gHKQ3Z6NN8VnsRRWTTPSaai7xMpHzAWtqRdDqewzi9fDqLQkPDfp4ZCm 8AxooCrRYyjKJSX+XyBUj0H7FnaZbt3PuV34QO7YL5fgCN8v6lATk7MvcU/8rMdDo/2n LtPeH4cRjp+Rs82XmVJqVDmLk4ANFPjGVA5uQNO7CVG9/0quEFboRWFPmchMHu4uVKmK aKmV/yOUyeO20Hwou2Obf3QxnzX71yTPutK+9YGM7abtexVGOylKTD474WaUBCWkErF1 racQ==
X-Gm-Message-State: AOAM530S+mEOsyNnQuORHZHxgVtm59Z8QBATv2gXJlyj5OkZcPe4ePKh HNXL6opKS4pN3SkZ9WgfT9gHSnVPKpXLSE6eyqTNlCbJXdQ3Gw==
X-Google-Smtp-Source: ABdhPJw26e+C4wHv2VAJvoHp6T46L+T6pk1kFwOvytVR9ZXf19iOucZjCWorYd+On1IO/8Z6ne3OlL4tlsknogX9PF4=
X-Received: by 2002:a9f:3230:: with SMTP id x45mr22728908uad.23.1618317871067; Tue, 13 Apr 2021 05:44:31 -0700 (PDT)
MIME-Version: 1.0
References: <DM6PR15MB237941DDA59DF2A67A2F52B7E3969@DM6PR15MB2379.namprd15.prod.outlook.com>
In-Reply-To: <DM6PR15MB237941DDA59DF2A67A2F52B7E3969@DM6PR15MB2379.namprd15.prod.outlook.com>
From: Cigdem Sengul <cigdem.sengul@gmail.com>
Date: Tue, 13 Apr 2021 13:44:20 +0100
Message-ID: <CAA7SwCNmxax3F222eeYyQ1rEOq+cOZzZwT1Y4+CPBrJB+8XtXw@mail.gmail.com>
To: Daniel Migault <daniel.migault=40ericsson.com@dmarc.ietf.org>
Cc: "ace@ietf.org" <ace@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000d6b6ed05bfd9fd54"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/W2QOM3Z92VNGkxiPeO_HTH9dn14>
Subject: Re: [Ace] MQTT, OSCORE, DTLS profiles - recommendation on RS - AS communication
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Apr 2021 12:44:37 -0000
Hello Daniel, I propose the following change to clarify the TLS use - if you are happy with it, I will update the document: To provide communication confidentiality and RS authentication to MQTT clients, TLS is used, and TLS 1.3 [RFC8446] is RECOMMENDED. This document makes the same assumptions as Section 4 of the ACE framework [I-D.ietf-ace-oauth-authz] regarding Client and RS registration with the AS and setting up keying material. While the Client-Broker exchanges are only over MQTT, the required Client-AS and RS-AS interactions are described for HTTPS-based communication [RFC7230], using 'application/ace+json' content type, and unless otherwise specified, using JSON encoding. The Client-AS and RS-AS MAY also use protocols other than HTTP, e.g. Constrained Application Protocol (CoAP) [RFC7252] or MQTT; it is recommended that TLS is used to secure the communication channels between Client-AS and RS-AS." Since it is in this paragraph, one thing that Francesca brought up to do is to register the 'application/ace+json' content type. Kind regards, --Cigdem On Fri, Mar 5, 2021 at 9:11 PM Daniel Migault <daniel.migault= 40ericsson.com@dmarc.ietf.org> wrote: > Hi, > > > > Now that the authz document is being consolidated, I do have some minor > concerns regarding the recommendations mentioned in the profile documents, > that might require an additional update. > > The update to the authz document indicates more more clearly than before > that profiles need to provide some recommendations for the RS – AS > communication. > > > > “”” > > Profiles MUST specify for introspection a communication security protocol > RECOMMENDED to be used between RS and AS that provides the features > required above. “”” > > > > It seems to me the MQTT profile text makes it pretty clear that TLS is > recommended for all communications but I am wondering if additional > clarification would be beneficial – see below. That said I agree this is a > very minor point in this case that could be handled by the RFC editor. > > For the OSCORE or DTLS profiles, unless I am missing the RS – AS > recommendations in the documents , it seems to me it has been omitted and > needs to be added -- see below. > > > > > > Yours, > > Daniel > > > > ## MQTT - draft-ietf-ace-mqtt-tls-profile-10 > > > > “”” > > To provide communication confidentiality and RS authentication, TLS > > is used, and TLS 1.3 [RFC8446] is RECOMMENDED. This document makes > > the same assumptions as Section 4 of the ACE framework > > [I-D.ietf-ace-oauth-authz] regarding Client and RS registration with > > the AS and setting up keying material. While the Client-Broker > > exchanges are only over MQTT, the required Client-AS and RS-AS > > interactions are described for HTTPS-based communication [RFC7230], > > using 'application/ace+json' content type, and unless otherwise > > specified, using JSON encoding. > > “”” > > > > I am wondering if that would not be more appropriated to specify in the > first line RS and AS authentication or simply authentication. > > > > > > > > > > - OSCORE draft-ietf-ace-oscore-profile-16 > > “”” > > This > > profile RECOMMENDS the use of OSCORE between client and AS, to reduce > > the number of libraries the client has to support, but other > > protocols fulfilling the security requirements defined in section 5 > > of [I-D.ietf-ace-oauth-authz] (such as TLS or DTLS) MAY be used as > > well. > > “”” > > > > > - DTLS draft-ietf-ace-dtls-authorize-15 > > > > “”” > > It is RECOMMENDED that the client > > uses DTLS with the same keying material to secure the communication > > with the authorization server, proving possession of the key as part > > of the token request. Other mechanisms for proving possession of the > > key may be defined in the future. > > “”” > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace >
- [Ace] MQTT, OSCORE, DTLS profiles - recommendatio… Daniel Migault
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Göran Selander
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Daniel Migault
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Cigdem Sengul
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Daniel Migault
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Benjamin Kaduk
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Cigdem Sengul
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Daniel Migault
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Cigdem Sengul
- Re: [Ace] MQTT, OSCORE, DTLS profiles - recommend… Daniel Migault