Re: [Ace] Summary of ACE Group Communication Security Discussion

"Rahman, Akbar" <> Fri, 25 November 2016 15:57 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7B61A129702 for <>; Fri, 25 Nov 2016 07:57:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.096
X-Spam-Status: No, score=-1.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RDNS_NONE=0.793, T_KAM_HTML_FONT_INVALID=0.01] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id R8TGWwPnD7qy for <>; Fri, 25 Nov 2016 07:57:11 -0800 (PST)
Received: from (unknown []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 590A9129951 for <>; Fri, 25 Nov 2016 07:52:30 -0800 (PST)
X-ASG-Debug-ID: 1480089147-06daaa59a058d40001-Yzt3Th
Received: from ( []) by with ESMTP id Gl3qsHJaV5B5OCV9 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO) for <>; Fri, 25 Nov 2016 10:52:27 -0500 (EST)
Received: from ([fe80::4d8a:a889:67c2:f009]) by ([::1]) with mapi id 14.03.0319.002; Fri, 25 Nov 2016 10:52:27 -0500
From: "Rahman, Akbar" <>
To: Michael StJohns <>
Thread-Topic: [Ace] Summary of ACE Group Communication Security Discussion
X-ASG-Orig-Subj: RE: [Ace] Summary of ACE Group Communication Security Discussion
Date: Fri, 25 Nov 2016 15:52:26 +0000
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
x-exclaimer-md-config: bb79a19d-f711-475c-a0f9-4d93b71c94dd
Content-Type: multipart/alternative; boundary="_000_36F5869FE31AB24485E5E3222C288E1F6DCA095ENABESITEInterDi_"
MIME-Version: 1.0
X-Barracuda-Start-Time: 1480089147
X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA
X-Barracuda-Scan-Msg-Size: 21728
X-Virus-Scanned: by bsmtpd at
X-Barracuda-BRTS-Status: 1
X-Barracuda-Spam-Score: 0.00
X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 tests=BSF_SC0_MISMATCH_TO, BSF_SC5_SA210e, HTML_MESSAGE
X-Barracuda-Spam-Report: Code version 3.2, rules version Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 BSF_SC0_MISMATCH_TO Envelope rcpt doesn't match header 0.00 HTML_MESSAGE BODY: HTML included in message 0.00 BSF_SC5_SA210e Custom Rule SA210e
Archived-At: <>
Cc: "" <>, Rene Struik <>, "" <>
Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 25 Nov 2016 15:57:15 -0000

Hi Mike,

Thanks for pointing out all the issues with a symmetric key approach to group communication.  However, can you also give any thoughts on the specific vulnerability to the CA and certificates in the asymmetric key approach for IoT?  After all, there has been some well-known attacks on PKI infrastructure in the last few years such as:

Do you think it will be better or worse if IoT infrastructure start using certificates on a massive scale?  Or is it outside the scope of IETF standards and more of a deployment and operational issue?


From: Ace [] On Behalf Of Michael StJohns
Sent: Wednesday, November 23, 2016 1:22 PM
To:; Rene Struik <>
Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion

On 11/17/2016 7:00 PM,<> wrote:
Is anyone willing to work on a draft to be ready in advance of the Chicago meeting so we have a concrete proposal for asymmetric keys?

I'm just catching up on old mail after getting over a cold.

Mostly, this could be as simple as a two to four paragraph draft:

1) Use CORE section 5 for message formats. (e.g. public key signed messages) using one of several defined specific set of algorithms (e.g. sha256withecdsa and p256 or something smaller) chosen by the application.
2) The authentication bare public key is a configuration item for the end devices and placement is beyond the scope of this draft.
3) Tracking of a message ID from (1) to prevent command replay attacks.
4) Minimum numbers of controllers (e.g. public keys and actuation events or message ids) that an end system has to track.

(2) could be folded into a draft about configuring end devices.

A more complex model would be:
1) Place a root certificate on all end systems via configuration (also out of scope)
2) Describe the certification path algorithm (e.g. profile RFC5280)
3) Describe how the cert path certificates are carried in CORE section 5 messages.
4) plus 3 & 4 above.
5) plus how to operate in the presence of clock time.

Unlike symmetric key systems, there really doesn't need to be a key management/agreement/transport protocol per se.  It's all about a) what constitutes a valid message, and b) what do you do with the valid message once you get it.

An application specific draft would include message formats for things included in a CORE section 5 message (e.g. the specific values for turning on and off lightbulbs or setting their hues or intensity), but that's not really an ACE thing per se.



Please excuse typos, sent from handheld device

On Nov 17, 2016, at 11:26 PM, Rene Struik <<>> wrote:
Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies.
Please see my email to the list of July 26, 2016:
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016:

This seems to take the time latency argument away. The only other technical hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see

So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:
On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all,

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

·       The solution needs to define both, symmetric and an asymmetric group key solution.

There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".

Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.

·       The security consideration section needs to explain under what circumstances what solution is appropriate.

Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices.   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.


If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!


Ace mailing list<>


Ace mailing list<>


email:<> | Skype: rstruik

cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
Ace mailing list<>