Re: [core] Bootstrap in draft-ohba-core-eap-based-bootstrapping and draft-garcia-core-security

[Yoshihiro Ohba <[e-mail]>]

Hi Hannes, Bahcet,

Please see my comments below.

(2011/07/13 4:25), Behcet Sarikaya wrote:
> Hi Hannes (Kelly and Rene who replied to me only),
> 
> 
> Let me clarify.
> 
> I checked the Wiki page, it is about what I talked, i.e. bootstrapping your PC.
> I am OK with it.
> 
> In Core WG drafts, draft-ohba is about "bootstrapping" CoAP applications,
> establishing a secure channel between the CoAP client and CoAP server.
> 

Yes.

> As such it assumes a secure IP communication which is what we cover in
> draft-sarikaya.
> 
> I think that establishing a secure channel between the CoAP client and CoAP
> server should not be called bootstrapping.

For example, RFC 4640 discuss "bootstrapping MIPv6", and in its abstract:

"A mobile node needs at least the following information: a home
address, a home agent address, and a security association with home
agent to register with the home agent.  The process of obtaining this
information is called bootstrapping."

This means that bootstrapping MIPv6 security is part of bootstrapping
MIPv6.

Following the same logic, I think bootstrapping CoAP security can be
considered as part of bootstrapping CoAP application.

> 
> OTOH, draft-garcia is totally chaotic about "bootstrapping". In Section 3 it
> talks about  trust bootstrapping between nodes of
>     different vendors. Then it talks about bootstrapping phase/procedures.
> Later on they mention the bootstrapping of security keys.
> 
> Section 5.2 Bootstrapping of a Security Domain
> In Section 5.2.2 it tries to give a definition to bootstrapping.
> 
> My suggestions are:
> 
> for draft-ohba: please do not use bootstrapping, otherwise your draft is clear
> enough.

Since the term bootstrapping is already used for MIPv6 case, I think
it can still use the term, but I agree that the draft should say
bootstrapping CoAP security instead of bootstrapping CoAP application.

Regards,
Yoshihiro Ohba



> 
> for draft-garcia: This draft talks about so many things. In most places, what it
> refers to as bootstrapping and the description match what is covered in the
> original document which is draft-sarikaya. I suggest removing all those sections
> about bootstrapping because they are mostly repeating what we already had. Stay
> with whatever remains and see if it is worth to have such a document.
> 
> Regards,
> 
> Behcet
> 
> 
> 
>> Hi Behcet,
>>
>> I agree with you that the term "bootstrapping" is not very  helpful.
>>
>> There are three cases:
>>
>> a) Key Distribution and Key  Derivation
>>
>> Here an existing keying material is used to derive other  keying material or to
>> use securely distribute keying material.
>>
>> draft-ohba-core-eap-based-bootstrapping and
>>
>> b) Bootstrapping (in  terms of operating systems procedures)
>>
>> See description in  http://en.wikipedia.org/wiki/Bootstrapping_%28computing%29
>>
>> draft-garcia-core-security  seems to refer to this aspect, I believe.
>>
>> c) Establishing initial  keying material in a leap of faith style.
>>
>> Example: Bluetooth pairing  protocol
>> http://tools.ietf.org/html/draft-pritikin-ttimodel-01 also discusses  these
>> aspects.
>>
>> Here the terms used are imprinting, pairing, enrollment, and  introduction are
>> used to describe
>>
>>
>> Ciao
>> Hannes
>>
>> On Jul 12, 2011,  at 8:08 PM, Behcet Sarikaya wrote:
>>
>>> Hi all,
>>>   It seems  that the word bootstrapping has been used and overused in so many
> 
>>>   drafts (including draft-ohba-core-eap-based-bootstrapping and
>>>   draft-garcia-core-security) and I suggest that we clarify this.
>>>
>>>   Colin had a draft on
>>> Initial Configuration of Resource-Constrained  Devices
>>> called draft-oflynn-6lowapp-bootstrapping submitted on Jan. 2010  in which he
>>
>>> defined bootstrapping ashow to initially     configure the network.
>>>
>>> Later on we continued this work on where  Colin left
>>> indraft-sarikaya-core-sbootstrapping.
>>>
>>> I  think that the definition Colin gave to bootstrapping is the right one. It
>>
>>> matches with the historical use of bootstrapping in computers: you  bootstrap
>>
>>> your computer to initially configure it by a physical action  (pressing a
>> button)
>>
>>> which loads a small record to the memory which when  executed bootstraps
>> (brings
>>
>>> the whole OS to the memory) the  system.
>>>
>>> Regards,
>>>
>>> Behcet
>>>   _______________________________________________
>>> core mailing  list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/core
>>
>>
> _______________________________________________
> core mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/core
>