Re: [core] Bootstrap in draft-ohba-core-eap-based-bootstrapping and draft-garcia-core-security

[Behcet Sarikaya <[e-mail]>]

Hi Hannes (Kelly and Rene who replied to me only),


Let me clarify.

I checked the Wiki page, it is about what I talked, i.e. bootstrapping your PC. 
I am OK with it.

In Core WG drafts, draft-ohba is about "bootstrapping" CoAP applications, 
establishing a secure channel between the CoAP client and CoAP server.

As such it assumes a secure IP communication which is what we cover in 
draft-sarikaya.

I think that establishing a secure channel between the CoAP client and CoAP 
server should not be called bootstrapping.

OTOH, draft-garcia is totally chaotic about "bootstrapping". In Section 3 it 
talks about  trust bootstrapping between nodes of
   different vendors. Then it talks about bootstrapping phase/procedures.
Later on they mention the bootstrapping of security keys.

Section 5.2 Bootstrapping of a Security Domain
In Section 5.2.2 it tries to give a definition to bootstrapping.

My suggestions are:

for draft-ohba: please do not use bootstrapping, otherwise your draft is clear 
enough.

for draft-garcia: This draft talks about so many things. In most places, what it 
refers to as bootstrapping and the description match what is covered in the 
original document which is draft-sarikaya. I suggest removing all those sections 
about bootstrapping because they are mostly repeating what we already had. Stay 
with whatever remains and see if it is worth to have such a document.

Regards,

Behcet



> Hi Behcet, 
> 
> I agree with you that the term "bootstrapping" is not very  helpful.
> 
> There are three cases: 
> 
> a) Key Distribution and Key  Derivation
> 
> Here an existing keying material is used to derive other  keying material or to 
>use securely distribute keying material. 
>
> draft-ohba-core-eap-based-bootstrapping and 
> 
> b) Bootstrapping (in  terms of operating systems procedures)
> 
> See description in  http://en.wikipedia.org/wiki/Bootstrapping_%28computing%29
> 
> draft-garcia-core-security  seems to refer to this aspect, I believe. 
> 
> c) Establishing initial  keying material in a leap of faith style. 
> 
> Example: Bluetooth pairing  protocol
> http://tools.ietf.org/html/draft-pritikin-ttimodel-01 also discusses  these 
>aspects. 
>
> Here the terms used are imprinting, pairing, enrollment, and  introduction are 
>used to describe 
>
> 
> Ciao
> Hannes
> 
> On Jul 12, 2011,  at 8:08 PM, Behcet Sarikaya wrote:
> 
> > Hi all,
> >  It seems  that the word bootstrapping has been used and overused in so many 

> >  drafts (including draft-ohba-core-eap-based-bootstrapping and 
> >  draft-garcia-core-security) and I suggest that we clarify this.
> > 
> >  Colin had a draft on 
> > Initial Configuration of Resource-Constrained  Devices
> > called draft-oflynn-6lowapp-bootstrapping submitted on Jan. 2010  in which he 
>
> > defined bootstrapping ashow to initially     configure the network.
> > 
> > Later on we continued this work on where  Colin left 
> > indraft-sarikaya-core-sbootstrapping.
> > 
> > I  think that the definition Colin gave to bootstrapping is the right one. It 
>
> > matches with the historical use of bootstrapping in computers: you  bootstrap 
>
> > your computer to initially configure it by a physical action  (pressing a 
>button) 
>
> > which loads a small record to the memory which when  executed bootstraps 
>(brings 
>
> > the whole OS to the memory) the  system.
> > 
> > Regards,
> > 
> > Behcet
> >  _______________________________________________
> > core mailing  list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/core
> 
>