Re: [core] Block Transfer and Object Security .... Re: Agenda

[Göran Selander <[e-mail]>]

Hi Hannes,

On 2016-03-28 16:44, "core on behalf of Hannes Tschofenig"
<[e-mail] on behalf of [e-mail]> wrote:

>Hi Carsten,
>
>the observation that a proxy has negative impacts on security when
> * hop-by-hop communication security is used in combination with
> * terminating that communication at the proxy
>is nothing that relates to the blockwise transfer itself.

See previous mail.

>
>In general, in such a setup the proxy has the power to change the
>content, re-arrange data, inject new data, etc.
>
>I understand that end-to-end security is important in such cases and of
>course raises the question about the use of intermediaries in the first
>place 

Intermediaries can also perform a security function by protecting
availability in terms of communication resources and power consumption of
constrained endpoints. I don’t see this as black or white, but as
conflicting requirements where different trade-offs are preferred
depending on the scenario. This is the topic of
draft-hartke-core-e2e-security-reqs, it would be interesting to hear your
comments on that.


>(particularly if they are supposed to make all sorts of
>computations, like aggregation and analysis, on that data).

Those kind intermediaries are currently out of scope in the draft
referenced above, but one of the topics for discussion in that slot on the
CoRE agenda is what kind of intermediaries this analysis should encompass.
Currently it is forward proxy and pub-sub broker, we are considering to
add reverse proxy and translational proxy (e.g. HTTP-CoAP).

Göran



>
>Ciao
>Hannes
>
>On 03/28/2016 02:14 PM, Carsten Bormann wrote:
>> Hi Hannes,
>> 
>>> I have re-read the Blockwise Transfer draft and the document does not
>>> give me the impression that there is any specific need to tie it to
>>> Object Security.
>>>
>>> Can you explain what the relationship is?
>> 
>> After the last call completed, we had a discussion on the IETF mailing
>> list how to employ object security in a block-wise transfer that spans
>> proxies.
>> If you secure only the complete representation, the cache in a proxy
>> might be poisoned by fake blocks, and you get an availability problem.
>> If you secure each of the blocks (and have a way for the proxy to be
>> part of a security association needed so it also can verify the blocks),
>> you can prevent that, but you still have to secure the way the entire
>> representation is composed from those blocks, and that might mean
>> additional components are needed in an object security protocol.
>> 
>> I agree that none of these considerations have a bearing on the
>> block-wise protocol itself, and this also was the resolution we reached
>> after the discussion.  But it was useful to have the discussion, and it
>> will inform the discussion about object security.
>> 
>>> I hope there is no plan to make the completion of Blockwise transfer
>>> dependent on the progress of object security.
>> 
>> No, as far as the CoRE WG is concerned, block-wise is done.
>> It is currently in IESG evaluation and on the agenda of the 2016-04-21
>> IESG telechat; Matthias Kovatsch is the shepherd.
>> 
>> Grüße, Carsten
>>