Re: [Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)

[Derek Atkins <[e-mail]>]

Hannes Tschofenig <[e-mail]> writes:

>> Particularly for constrained devices, it is unlikely that applications
>> will want to pay the performance penalty of generating and encrypting a
>> key management key to perform a MAC operation.  Heck, they may not have
>> credible random number generation in the first place!  And they are
>> likewise unlikely to want to pay the message size penalty of carrying
>> the encrypted key.
>
> It would be good to know what devices you have in mind in this discussion.
>
> I personally don't think we should target devices that cannot even do
> key management for symmetric cryptography. I would even argue that we
> should aim for devices that support a random number generator and are
> also able to do public key crypto.

I agree with all of this except for the RNG.  You don't need an RNG for
many use cases and can perform good security.  But of course it does
depend on the use-case.

> We are not doing ourselves a flavor if we place artificial constraints
> on our protocols that make them pretty insecure in practice. We already
> have enough insecure IoT devices in the market.

Sure.. Many IoT devices don't even try :)

> Here is the slide deck I presented in the LWIG group at the last IETF
> meeting; it explains the performance of state-of-the-art crypto on
> common Cortex M class MCUs.

I would quickly argue it's not "state-of-the-art" crypto.  It's ECC.
There are ... better... key agreement algorithms out there for IoT.

> https://www.ietf.org/proceedings/92/slides/slides-92-lwig-3.pdf

:)

> Ciao
> Hannes

-derek
-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant