Re: [core] [T2TRG] Quick Doodle T2TRG security topics (Re: New topic for T2TRG?)

[Göran Selander <[e-mail]>]

Hi Marco and all,

Thanks for taking a stab at structuring detailed topics! I was only missing the authority-related topic, which is probably mid-term, more below. My main comment, however, is that at the current stage of the discussion it would perhaps be good if the topics should were formulated even more in terms of "problem statements" or "goals". For some topics and some people the underlying problem may be more clear than for others. I'm not sure I understand all topics listed below . . . :-)

Perhaps we could add a high level description, for example
* efficient distribution of firmware updates to a large group of devices ...
* efficient secure communications between one endpoint other nodes in a connection over multiple proxies ...
* status of IETF standardization of secure group communication in constrained RESTful environments ...
* ways to represent and execute authority in constrained IoT settings with multiple stakeholders ...
...

Not saying this maps 1-1 to the different topics, nor that the previous formulation did a bad job explaining the topic, but perhaps a starting point to allow for a wider discussion?

Another topic I would like to raise is ways of working. One idea behind this activity was to allow for an open discussion of security related topics in the constrained RESTful IoT setting. Such a discussion exists in IETF WGs but is driven by progressing the the drafts in the scope of the charter, and much of the new work has been a result of breakout sessions and IETF hallway (lunch) discussions. With this in mind, I think we should not have all meetings filled with presentations of solutions, but also allow for more half-baked thoughts, provided - again - that there is a problem statement/goal that is understood and matches the scope.

But the best way to find our feet is probably just pick a topic and get started :-)

My 2 cents.

Talk soon!
Göran


On 2022-01-10, 19:37, "Marco Tiloca" <[e-mail]> wrote:
Hi all,

Building on the suggested structure from Carsten, please find below my
input for tomorrow's discussion.

Best,
/Marco


[Short-term]

* Distribution of FW update using group communication
--- Relation with SUIT
--- Actual FW image distribution with multicast messages
--- Different key provisioning methods to enable different encryption of
FW image

* Indication of alternative transports for CoAP
--- Security context propagation; OSCORE interaction


[Mid-term]

* Pub-Sub for CoAP
--- Sanity-check of CoRE draft, and its relation with the ACE pub-sub
profile
--- Facilitate progress and writing of security considerations
--- Elaborate/explore on availability, confidentiality, integrity,
provenance

* Pedagogical overview of secure group communication based on multicast
--- Available technologies and how they relate/interact also from a
lifecycle point-of-view
--- Material for a "technology survey" giving the big picture (worth an
Informational Internet Draft ?)

* Key update for OSCORE
--- With or without Perfect Forward Secrecy; survival of observations;
update of identifiers; application-specific considerations affecting key
usage limits
--- Relevant also to 6TiSCH and LwM2M, as alternative to OSCORE Appendix B.2

* Non-traditional responses
--- Including also multicast notifications and non-notification
responses over multicast
--- How they can be protected

* Nested OSCORE protection
--- Raise awareness of ongoing work
--- Use cases include LwM2M when also using OSCORE with an external
Application Server
--- Multiple nesting as building block towards hiding clients


[Long-term]

* Any security clarifications on CoRE-related topics
--- Some are in the CoAP-FAQ of the CoRE wiki
--- This can be material for the Corrclar document

* Self description and trusted assertion on security properties of
devices and their resources



On 2021-12-21 18:17, Carsten Bormann wrote:
> So we had the first hour of discussion, and it was interesting to see how many areas of potential work we could actually make out beyond what I had prepared.  See notes referenced below.
>
> We decided we would spend some time individually, grouping the activities listed (and our favorite additions) into
>
> — short term (do now)
> — mid term (examine and turn into one or more short-term items during year 2022)
> — long term (same, but really with a longer outlook and some “freezer” semantics for now).
>
> So we’ll try to have a few short emails (“documents”) out with this by Monday, 2022-01-10, and meet again 2022-01-11 at 1600Z again to merge and make this more concrete.
>
> An actual work meeting, with prepared discussion points (“presentations”, but really mostly for discussion), would then be next.
>
> Grüße, Carsten
>
>
>> On 2021-12-21, at 16:24, Carsten Bormann <[e-mail]<mailto:[e-mail]>> wrote:
>>
>> Some initial slides at
>>
>> https://eur05.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftzi.de%2F~cabo%2Ft2trg-chat-2021-12-21.pdf&amp;data=04%7C01%7Cmarco.tiloca%40ri.se%7C9806e72b2dd54b47d99908d9c4a5d64e%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637757039703600342%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=wQBOnCHQPlvPFL0EqL%2Fswb1PZ1Ubp%2B1OPqwZO3E6VkY%3D&amp;reserved=0
>>
>> We will collect notes at
>>
>> https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnotes.ietf.org%2Fnotes-t2trg-chat-2021-12-21&amp;data=04%7C01%7Cmarco.tiloca%40ri.se%7C9806e72b2dd54b47d99908d9c4a5d64e%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637757039703600342%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=HfT8bRiYA61Gv9OqCQ0S3QVs930tZdZDA6vepNeTBHI%3D&amp;reserved=0
>>
>> See you in 35 minutes…
>>
>> Grüße, Carsten
>>
>>
>>> On 2021-12-21, at 11:26, Carsten Bormann <[e-mail]<mailto:[e-mail]>> wrote:
>>>
>>>> I have put up 9 potential meeting slots this week:
>>>> https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdoodle.com%2Fpoll%2F7e76k335hd6d28k3&amp;data=04%7C01%7Cmarco.tiloca%40ri.se%7C9806e72b2dd54b47d99908d9c4a5d64e%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637757039703600342%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=soxd4zAu4MXN0dDvWXdGzAgsA%2Bzv3muiYNxXrL7Mrm8%3D&amp;reserved=0
>>> The doodle was in favor of 1600Z today (1100 EST, 1700 CET, 1800 EET).
>>>
>>> Webex info:
>>>
>>> Meeting link:
>>> https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fietf.webex.com%2Fietf%2Fj.php%3FMTID%3Dmd00b3797e6b5d123cd2689f53b076f11&amp;data=04%7C01%7Cmarco.tiloca%40ri.se%7C9806e72b2dd54b47d99908d9c4a5d64e%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637757039703600342%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=W6DZPwMmYu8%2F5AMNgg7UXjI15VMKFl%2Fz18HixGKAdCc%3D&amp;reserved=0
>>> Meeting number:
>>> 2428 335 7567
>>> Password:
>>> constrained
>>>
>>> I hope to have an agenda prepared in a few hours.
>>> As I said, this is going to be an informal chat in preparation of the real work.
>>> Talk to you then!
>>>
>>> Grüße, Carsten
>>>
>> _______________________________________________
>> core mailing list
>> [e-mail]<mailto:[e-mail]>
>> https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fcore&amp;data=04%7C01%7Cmarco.tiloca%40ri.se%7C9806e72b2dd54b47d99908d9c4a5d64e%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637757039703600342%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=RC20p6T2mDgG99zMTdvGbUhOZWg1JN7bkkl6cRL6UV8%3D&amp;reserved=0
> _______________________________________________
> T2TRG mailing list
> [e-mail]<mailto:[e-mail]>
> https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Ft2trg&amp;data=04%7C01%7Cmarco.tiloca%40ri.se%7C9806e72b2dd54b47d99908d9c4a5d64e%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637757039703600342%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=H024uZhd3y9ssFcAoEvCXjOrHz4L7AAxdOZh5sDQ3Fo%3D&amp;reserved=0

--
Marco Tiloca
Ph.D., Senior Researcher

Division: Digital System
Department: Computer Science
Unit: Cybersecurity

RISE Research Institutes of Sweden
https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-3d296ae5721cac2b&q=1&e=634c9d10-c880-4637-a41e-44d9fb24ac16&u=https%3A%2F%2Fwww.ri.se%2F

Phone: [phone]
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)