[Ace] Multicast notifications for distributing public keys to other group members

Göran Selander <goran.selander@ericsson.com> Mon, 04 May 2020 11:18 UTC

From: Göran Selander <goran.selander@ericsson.com>
To: "core@ietf.org" <core@ietf.org>, "ace@ietf.org" <ace@ietf.org>
Thread-Topic: Multicast notifications for distributing public keys to other group members
Thread-Index: AQHWIgXHzV9mp3zMoEOsNx4hgbX4VQ==
Date: Mon, 04 May 2020 11:18:47 +0000
Message-ID: <F9E18233-30E6-49A6-965F-5728655D5519@ericsson.com>
Accept-Language: en-US
Content-Language: en-GB
user-agent: Microsoft-MacOutlook/16.36.20041300
Content-Type: text/plain; charset="utf-8"
Content-ID: <3E46990F4CE77A448017D45AF59815A5@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: f70fc3b8-1b52-4f5e-3cd5-08d7f01cea65
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 May 2020 11:18:47.7741 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 4qENbUXI0z6xBo5B9nlOUTj6DcfyiJwBjy1SHaVxj308RBOS5Pm9pTTw4D17MoWIwv5L7TWOAawNh/OnAxeRHiP0hnh7IT8+NFjEKWCITp4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR07MB6293
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/s4J7CSk5MA9lpllhwaUWm-z6p1s>
Subject: [Ace] Multicast notifications for distributing public keys to other group members
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 04 May 2020 11:18:52 -0000

Dear CoRE and ACE,

Apologies for cross-posting, this concerns the security for CoAP group communications (which is a CoRE draft) and the current specified method to retrieve public keys for group communication (which is an ACE draft).

When a node joins a group [0] there is a need for group members to get its public key. Section 4.5 of the current Github version of draft-ietf-ace-key-groupcomm "Key Provisioning for Group Communication using ACE" [1] describes procedures for retrieving the public keys, by accessing the resource "ace-group/GROUPNAME/pub-key" in the KDC. Section 4.3 in the same document describes the procedure to "make the ... resource Observable, and send notifications to Clients when the keying material is updated".

1. The use of notifications is good to avoid similar requests from several nodes in these cases. But the procedure is only mentioned briefly as quoted above. Would it be possible to expand on this and make it a recommended mechanism in this draft, or alternatively, a separate draft?

2. If the number of members in the group is large, it would be even better to send just one multicast notification [2] instead of many notifications with the same content, but this requires the sending node to be member of the group. The Group Manager is the authorized party distributing public keys to nodes of the group, but we don't think of it as member of that group. Is it worth to make the GM a group member by default to enable the use of [2] for distribution of the public key of a (re-)joining node?  

Göran

[0] https://tools.ietf.org/html/draft-ietf-core-groupcomm-bis
[1] https://ace-wg.github.io/ace-key-groupcomm/draft-ietf-ace-key-groupcomm.html#name-retrieval-of-public-keys-an
[2] https://tools.ietf.org/html/draft-tiloca-core-observe-multicast-notifications

[Ace] Multicast notifications for distributing pu… Göran Selander