Re: [Atlas] Application Transport LAyer Security (ATLAS) Charter Text

[Hannes Tschofenig <[e-mail]>]

Hi Carsten,

A few remarks below:

-----Original Message-----
From: Carsten Bormann [mailto:[e-mail]]
Sent: 02 February 2018 13:12
To: Hannes Tschofenig
Cc: [e-mail]
Subject: Re: [Atlas] Application Transport LAyer Security (ATLAS) Charter Text

On Feb 2, 2018, at 12:53, Hannes Tschofenig <[e-mail]> wrote:
>
> embeddings for different application protocols, such as CoAP, HTTP, and Bluetooth Smart

Hannes,

I’d sure like to complete CoDTLS, so that looks much better for me now.
I would expect we can define media types that work for both CoAP and HTTP, so that integration should probably be left open as something for the WG to decide.

[Hannes] That's also my thinking. Working on the ATLS draft(s) I had the impression that the differences between CoAP and HTTP are small enough to justify putting the functionality in one document.

Not so sure about “Bluetooth Smart” — are we optimistic with respect to attracting enough people that at least know that this is no longer the name of Bluetooth Low Energy :-)

[Hannes] A fair concern. I have just have seen repeatedly how people mess up Bluetooth Smart security. Hence, I wonder whether a standardized approach in the IETF (which is the home of TLS) would make sense, or is at least worthwhile to try.

I’m also not so sure about the Architecture and Use Case document as a separate item; we could simple add a page or two to the introduction of the media types document.

[Hannes] I wasn't quite sure about this either. On one hand draft-friel-tls-atls-00, for example, contains use cases but on the other hand I also know that there are various use cases to describe (from my work in the OMA Device Management group). If there are different profiles for the various application layer protocols then you may not want to repeat the same content over and over again. Maybe this is something for the group or the ADs/IESG to decide.

Finally, I’ll have to add the ceterum censeo that I don’t think the complex TLS should have a monopoly on key agreement protocols, and that I think we should also complete EDHOC.

[Hannes] I does not have a monopoly even today since we have the great IKE/IPsec stuff as well.

Do we have a position on TLS/DTLS 1.3?  Or is that for the WG to decide?

[Hannes] I believe we need a solution that works for TLS / DTLS 1.2 and 1.3. Deployment-wise I would favour 1.3 due to the better performance and improved security.

Ciao
Hannes

Grüße, Carsten

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.