Re: [core] Question reg. draft-fossati-tls-iot-optimizations-00

["Fossati, Thomas (Nokia - GB)" <[e-mail]>]

Hi Kai, Achim (sorry for the late reply, I wasn't looking at the TLS list).

IIRC the idea came from Stephen (Farrell) in an attempt to add
privacy-preserving properties to the (potentially) long term identifier.

It's clearly a strawman and I'm happy to discuss its merits (in particular
the fact that when NAT rebinding happens without the client knowing it in
advance, the privacy of this is already gone) and impact in the IoT space
(in term of state that is kept on server side if handling multiple
connections at a time).

However, whatever the mechanism we come up with, I think privacy
preservation should be a goal, or at least something that is taken as a
first class criterion for selection.

Cheers, t


On 02/11/2016 07:29, "core on behalf of Hudalla Kai (INST/ESY1)"
<[e-mail] on behalf of [e-mail]> wrote:
>Hi list,
>
>I have attended last week's meeting of the T2T RG in Ludwigsburg where we
>had a
>vivid discussion around the problems of DTLS on mobile and other NATed
>networks
>where the device's IP address and/or port are expected to change once in
>a while.
>
>We quickly came to the conclusion that the CoAP spec will need to be
>changed in a
>way that removes the transport's addressing information from the
>Request/Response
>matching criteria when using DTLS.
>
>However, what alternative mechanism could be used instead?
>
>Section 4.2 of draft-fossati-tls-iot-optimizations-00 proposes to use a
>connection ID as part of the DTLS record structure. While I understand the
>usefulness of using a "long term identifier" for associating the session
>with the
>client, I do not really understand, how a "hash chain" could be put to
>use in
>this context to provide an improved level of privacy.
>
>Could someone (of the authors) comment on that?
> 
>-- 
>Mit freundlichen Grüßen / Best regards
>
>Kai Hudalla
>Chief Software Architect
>
>Bosch Software Innovations GmbH
>Schöneberger Ufer 89-91
>10785 Berlin
>GERMANY
>www.bosch-si.com
>
>Registered office: Berlin, Register court: Amtsgericht Charlottenburg,
>HRB 148411 B;
>Executives: Dr.-Ing. Rainer Kallenbach, Michael Hahn
>_______________________________________________
>core mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/core