Re: [Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)

["Jim Schaad" <[e-mail]>]

I will freely admit that I do not know what the sizes of constrained devices
are today.  Based on the talks that I have heard on what is a constrained
device, I generally think of a range starting with a Z80 plus some side
hardware for AES and work up from there.  I generally don't think of 286's
as being all of that constrained let alone something that can actually do
64-bit natively.  At that point all one is looking at is power supply
constraints.

Jim


> -----Original Message-----
> From: Derek Atkins [mailto:[e-mail]]
> Sent: Wednesday, July 08, 2015 9:44 AM
> To: Hannes Tschofenig
> Cc: Brian Campbell; Jim Schaad; Mike Jones; [e-mail]
> Subject: Re: [Cose] Key management for MACs (was Re: Review of draft-
> schaad-cose-msg-01)
> 
> Hannes Tschofenig <[e-mail]> writes:
> 
> >> Particularly for constrained devices, it is unlikely that
> >> applications will want to pay the performance penalty of generating
> >> and encrypting a key management key to perform a MAC operation.
> >> Heck, they may not have credible random number generation in the
> >> first place!  And they are likewise unlikely to want to pay the
> >> message size penalty of carrying the encrypted key.
> >
> > It would be good to know what devices you have in mind in this
> discussion.
> >
> > I personally don't think we should target devices that cannot even do
> > key management for symmetric cryptography. I would even argue that we
> > should aim for devices that support a random number generator and are
> > also able to do public key crypto.
> 
> I agree with all of this except for the RNG.  You don't need an RNG for
many
> use cases and can perform good security.  But of course it does depend on
> the use-case.
> 
> > We are not doing ourselves a flavor if we place artificial constraints
> > on our protocols that make them pretty insecure in practice. We
> > already have enough insecure IoT devices in the market.
> 
> Sure.. Many IoT devices don't even try :)
> 
> > Here is the slide deck I presented in the LWIG group at the last IETF
> > meeting; it explains the performance of state-of-the-art crypto on
> > common Cortex M class MCUs.
> 
> I would quickly argue it's not "state-of-the-art" crypto.  It's ECC.
> There are ... better... key agreement algorithms out there for IoT.
> 
> > https://www.ietf.org/proceedings/92/slides/slides-92-lwig-3.pdf
> 
> :)
> 
> > Ciao
> > Hannes
> 
> -derek
> --
>        Derek Atkins                 617-623-3745
>        [e-mail]             www.ihtfp.com
>        Computer and Internet Security Consultant