IETF Logo Mail Archive

Re: [Danish] IoT Device Identification with TLSA via Danish

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Sat, 19 June 2021 12:51 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: danish@ietfa.amsl.com
Delivered-To: danish@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AD983A0D20 for <danish@ietfa.amsl.com>; Sat, 19 Jun 2021 05:51:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=DlJIw6BD; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=DlJIw6BD
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LxXLg_tDKR1i for <danish@ietfa.amsl.com>; Sat, 19 Jun 2021 05:51:28 -0700 (PDT)
Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on2061.outbound.protection.outlook.com [40.107.20.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CDE93A0D1E for <danish@ietf.org>; Sat, 19 Jun 2021 05:51:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q3KUTT5qO3WroS6BMkJyRe0NuyD+ck76vWgvvLGp+k0=; b=DlJIw6BDZJG1j7WJGCdhULGTPT06cfxCZOyA91zwS+R/TspXWUH3DPVPUvZs1XrH+D6Qm8Bo1Dm1hBvwV+1xWmWabWx6YX+nmgj9FKquPXnxS0u8EOizz80z1Uu9xghDLLceHQWJVamaMRB9OvUHDFPCoVuHGXSQiH+aceswbVI=
Received: from PR0P264CA0230.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:1e::26) by VI1PR08MB5392.eurprd08.prod.outlook.com (2603:10a6:803:131::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.18; Sat, 19 Jun 2021 12:51:24 +0000
Received: from VE1EUR03FT056.eop-EUR03.prod.protection.outlook.com (2603:10a6:100:1e:cafe::89) by PR0P264CA0230.outlook.office365.com (2603:10a6:100:1e::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.18 via Frontend Transport; Sat, 19 Jun 2021 12:51:24 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=pass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT056.mail.protection.outlook.com (10.152.19.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.16 via Frontend Transport; Sat, 19 Jun 2021 12:51:23 +0000
Received: ("Tessian outbound f945d55369ce:v96"); Sat, 19 Jun 2021 12:51:22 +0000
X-CR-MTA-TID: 64aa7808
Received: from a76260b396c3.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id E4C04E5F-2CE9-410A-97A4-D2BF58D84D00.1; Sat, 19 Jun 2021 12:51:17 +0000
Received: from EUR05-VI1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id a76260b396c3.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Sat, 19 Jun 2021 12:51:17 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=b8+vbxDenuhtZYN1r6RFqCRQaLinCuJIGlo5lpOlGr1SEmTnSuYTfkLNjuyE+4otGxDo6Y1C1m1TzyvEQcQUwfPYb+JQ9Vt4m2+CLf2m9a3osZE0bF/U8mQqUi67VS4D8N0EgTlWKtlkViIiptqo5OijAVwQaIRLpFei2YHS9uiA9B8M4Uv4wgqJ3asTxgtnnXbWNmE942tiGqW7+NBQ/DDWIJTK97HlQ6rXc5CE+XWfzmC8XjhK+Cbo+uPDUIm3HZXGfH1igPg5M7Rz2T8Dgf/D02z559uVPRPy+AWtQaOj1/WStxcGhoUm/PZTERMwfrcpiuJLJQ05E7C5gFt3gg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q3KUTT5qO3WroS6BMkJyRe0NuyD+ck76vWgvvLGp+k0=; b=DBVI+AV2Mk3+BZ0HYEECF3CvHSfyEmho0Xkn3psm3Ejywzm73jTyFz+V5xSZmvSO2Cg8ho7BrXqUTJ2dltXo40DDQ4hHo/El7+DdrKWhZBE8+l7Wn5vGT9D1VYFCkzQ8PZ2HXTAOlSlhwA+UmJTbs8wdr0f0sYzKI7YZwd0WeSNUMxovaTLU+q3RNKrYUFjztm2CfBsI6GJuf4VLx/bTTeKa4/nW9jCetfvvCklLOEiXP52w/M5VPtMpA9GGrAJm7aTfH5HwFS6nGM03tNwcWjXCNfCnrZz0qSKjBKCvOjM7U5gK9FZWSTuM5y/vARERWHbYHKn+mUkFvjAWsqu8pA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q3KUTT5qO3WroS6BMkJyRe0NuyD+ck76vWgvvLGp+k0=; b=DlJIw6BDZJG1j7WJGCdhULGTPT06cfxCZOyA91zwS+R/TspXWUH3DPVPUvZs1XrH+D6Qm8Bo1Dm1hBvwV+1xWmWabWx6YX+nmgj9FKquPXnxS0u8EOizz80z1Uu9xghDLLceHQWJVamaMRB9OvUHDFPCoVuHGXSQiH+aceswbVI=
Received: from DBBPR08MB5915.eurprd08.prod.outlook.com (2603:10a6:10:20d::17) by DB8PR08MB5019.eurprd08.prod.outlook.com (2603:10a6:10:e0::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.21; Sat, 19 Jun 2021 12:51:15 +0000
Received: from DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::69cf:4429:a804:7f41]) by DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::69cf:4429:a804:7f41%3]) with mapi id 15.20.4242.023; Sat, 19 Jun 2021 12:51:15 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Jacques Latour <Jacques.Latour@cira.ca>, "danish@ietf.org" <danish@ietf.org>
Thread-Topic: IoT Device Identification with TLSA via Danish
Thread-Index: AddhKvcSXHMYMAB6StqY1oKWkaM4dwD3nhkg
Date: Sat, 19 Jun 2021 12:51:15 +0000
Message-ID: <DBBPR08MB5915F04A83054BBEB4F9FE7BFA0C9@DBBPR08MB5915.eurprd08.prod.outlook.com>
References: <02cb8931e16c4ccaa6eed1b89c0a20b6@cira.ca>
In-Reply-To: <02cb8931e16c4ccaa6eed1b89c0a20b6@cira.ca>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ts-tracking-id: CD8C28FF370B9E45B0F1835888C29426.0
x-checkrecipientchecked: true
Authentication-Results-Original: cira.ca; dkim=none (message not signed) header.d=none;cira.ca; dmarc=none action=none header.from=arm.com;
x-originating-ip: [80.92.123.248]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-Correlation-Id: def93fbf-49ca-4ed3-2090-08d93320f191
x-ms-traffictypediagnostic: DB8PR08MB5019:|VI1PR08MB5392:
X-Microsoft-Antispam-PRVS: <VI1PR08MB5392CB505B6E3AAE20C3DD5AFA0C9@VI1PR08MB5392.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: Aom9NPsUERgpnmUdMM7X7ETreznVH4yQwcx2/iyJm3/A0t5rGrxeBdEdcmzkBWMvROCgykGpnSG4d7F/TXtI2wdzzfYQQLxUbdYKm5+mfr3hK+DmYc6NM/I7etaJrcToQhKz79KtUmhUHPrLOss51VUMyJYGXVOEGDGj+Bxri2D18rfCzZowtjrzqCXsaiAD6fybiI32RFyXpyClJsseJ7XH6jBkDLEjAWau3ibg/n5OTm+ZAbnS+0zXtS7DDE9qcMrDRLkEoQ9WGoY6l/EKdfDRyWihQs0NoIo+d9M68ddc+zJs5CyzaEpKI0Ie7U+vzJG1DgUR2RBk0fhg6t2OFzzKiwItSb4dsqEQE5XN7mfliWnmRG1VgSBd6twizPj2pHmkGfg0mRvX64AF9gqB502gx7ClusIcZFuHVG4TQN8bPUA8e3znq/RIL6grMZA3SP4CE80a/luffZ2Vvwc/pCE7BMeTmyebqa6WWDLykbz+URfJH1h/q4fKuRtusLMZcE5GFSceDnyFEpVL6D7rZ/PZSj/pp3FeVHytfiQSfpw57i1f85JzAeieEIy2dnsFAhcXJv7Y/ojqofML3AKSN9OI9xwUpT3Xbk3uVuGzm7Ho6pEZm2jZmexkHqhaB/kNcHDLddE+IYjOpM71iPMoTo8MZzTeydnlDGUDaoTlsryuM15hnNrsFvZ+4jM4eJgjSuZ3gercP4VuErhKpbfSFHtP8ugNzHX/Sv2GZqc21PY=
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5915.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(136003)(366004)(39850400004)(376002)(346002)(2906002)(478600001)(7696005)(316002)(52536014)(110136005)(966005)(66446008)(64756008)(66556008)(66476007)(76116006)(66946007)(33656002)(8676002)(5660300002)(26005)(122000001)(38100700002)(186003)(86362001)(6506007)(53546011)(71200400001)(8936002)(9686003)(9326002)(55016002)(166002)(83380400001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: VNI/z3VXG8pOc1Vg22Yb0Yl8JGsbQHgMkc/gU9UehX6bgMAO/ly8vD00v841uSVbxo5PqbJJfp0s+ZkEL+ZeYn67NE9REWMjRAoO35+j1lxXDZOW4pXCrOHJ5EjfdEXJ8F4viXBarB/m6x/7V/a9lKYvY7e/R2enWDQ5SVla3sSnCb1rqKToXvKZJJDI1beE4C8bFQLdfi+hep8MseFJ9/wvcjwUVopUi6FjTtuZBqUFRYjPI2OKerBFceaO5pGmNaOrkDefGU7lXKXBxcLFe6cXEmeQuyWcamo47r/YArGtV8DVBrgslAnCpIS9lRUMWV+tLCJdTecT5eRBnhsyH95scYKJbLQ7KY/R+M4q3APPM3GVjTYjCLtEeW9/giQ+k7ATq0AGEZ117BdleoJ6iotUBB9MDuwABTU+vG4qfhhVMybE+svZm9sdtrV1lNl+rlBSKLu5mX/FS+BBCzg0dwZsMW3hh797azyApBuyKL2PA/EsGmm9k4rj/n1s10ZWP5m1hWsRRQ9VoIaRUyG4+3yC8/a5PjhbdIfXuLa2dlS5+Fw0jsxfhZXM0SVNyXGWTJD92QTJxU2h9FpAG98472MeHrWkQtw3KGEYWAl0dKhmzk2sULOlKyooOIL+mhqyXItoj5gUHYQ5vWEXHihXaAcLtFoi+ns6iE2fbDh9h0sMr52OKXefPtCgFoSampPl60mGWQBV29+MNEKZuppxYa2CiwP8klG3BFu2ZDzcK+9CFRHf79rL8Mc8Yxk7ce49PnygkcZzavDWPnC/MYejDb9MF5lloL3CHNK6x6lYYsMiuzYcwTKjdc2frOD/8saWSXxrPfnL1L4yESLxHeKCnz2hhcVplYNNQrcKBet0hUiU32LeILj040s9mDg1S2h5yFNbC4uu7AphFpoTySfgYl7+udgIeyh2ibXf9zTrdYlwT06OTjF/s7G5XXmUy7LRe5yWfYY3TJD+gUSkqqb/CYqujluTZosCEhrx6MDRIJkdBaN9YJ+Po0DaClSExCOZkDsKDnur1YXlL6BaDNfyQNAE8T5pGbo7ewThd21fOG8nxk7+uY8vRNFTdjPg3sfv8SSgBRfzZj6vuHWmd3I0+T0eP5Nc+e2HUVwpO1I8ME0dGCaVpgbyYTNucbgbdyBLLLqgEUJYyITasnL19g076USc5p7bXfYiwiUa0mCL4Vftnpe9gxZ7GZWvf46RADkmbeiOL1LzYlkX00yqNCJ+V3+5hvYP1+waDvL5N9OZ48Bp9ihixYIMi1LCKtOUbCnITwTs4FzJOQ9u3aLfIGAPdtHqYyOgTBbDJGjc4BCqu50gLaP9xyPX0mnxESOpmR3u
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_DBBPR08MB5915F04A83054BBEB4F9FE7BFA0C9DBBPR08MB5915eurp_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB5019
Original-Authentication-Results: cira.ca; dkim=none (message not signed) header.d=none;cira.ca; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT056.eop-EUR03.prod.protection.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs: 28821f79-ef70-49ba-4e88-08d93320ecc3
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: oSx5PDPEXeGrM7hZreEgvhhYItjwAMnKAEuPuT5acjNMHus0gF43w6hiJzEc9LcA7EfrZl3A2m82w7y3e91/QmscJ3Ra56MtXzklEWGfcpgNHYsg+lhNZYsDiqK4XjDzYNNJsGDcGrhrDbbXRwfbatUcmGA9NRsNMw0kX0KVQ7hZv8nw6HYTqV4hOQmrWPdr8hW+U3hyt+Y3/JZT5NzgCIj5nbtG0llEioTJkXceOIAPlFCLxJaHQEPaP+nL0LuRnR3qS9OmDbLh8U+MZJdL8dfHWv4h+R40JMJ8rRszu05FvN+DhbXOdky/p+xLD+RfkEnCdM6eegJi9gcx+f4iDvTOkJ/FbYNnFdTMwsF/TM9XiiMXQgvT4z1fhFbqHeH0teBvdcWl/AoDKG7EPkb5xPsboTPeWg2tH9y9DQU/1AUX21TwxoJtmiCnh53Kzbape+4T9qHqIJCjb1porqMqPTeaWLlb7gEIc1Qc4GlR1o0XygEQEdO9pLSh9aXQ0t/L6O1nL/1yeW8yOWKkBxsJJbKvb6KOwyq5ySonfe0up6XWQdfZ/NT2/G5/iWyU+18LXInjzmfAh7HAOcEFh4Q2KDNqvybaVmD25tbl82Kp5fytPeGA/z2lc5I893GxT3LSoiFegNRDY4e40sk0IgYtSoV6imcRG0T2//hoBqYVW/NQPvnRewu2IDofsVmUmY+QAVZVgAIFDoVNVhu6LUIZ6T5QXWJTm0NXIOl+XzPp+qEH9oz/gWGjAu0L0zJbWwLMIF7MSsHK0TdoaVSMPfgSsQ==
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(346002)(136003)(376002)(39850400004)(396003)(36840700001)(46966006)(82310400003)(8936002)(110136005)(36860700001)(7696005)(70206006)(966005)(8676002)(166002)(9686003)(5660300002)(70586007)(47076005)(81166007)(478600001)(86362001)(356005)(82740400003)(55016002)(53546011)(52536014)(316002)(336012)(33656002)(83380400001)(26005)(6506007)(2906002)(186003)(9326002); DIR:OUT; SFP:1101;
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jun 2021 12:51:23.2916 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: def93fbf-49ca-4ed3-2090-08d93320f191
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: VE1EUR03FT056.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB5392
Archived-At: <https://mailarchive.ietf.org/arch/msg/danish/L-kJwPvNJdcAqtTYUOu-Vmeq9M8>
Subject: Re: [Danish] IoT Device Identification with TLSA via Danish
X-BeenThere: danish@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DANE AutheNtication for Iot Service Hardening <danish.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/danish>, <mailto:danish-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/danish/>
List-Post: <mailto:danish@ietf.org>
List-Help: <mailto:danish-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/danish>, <mailto:danish-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 19 Jun 2021 12:51:32 -0000

Hi Jacques,

Thanks for sharing your slides. Since the slides are not meant to be self-explanatory I have a question for you: What is an IoT registry for you?
(You mention the term on slide 2 and it seems to be core to your presentation.)

Ciao
Hannes

From: Danish <danish-bounces@ietf.org> On Behalf Of Jacques Latour
Sent: Monday, June 14, 2021 4:41 PM
To: danish@ietf.org
Subject: [Danish] IoT Device Identification with TLSA via Danish

Hi,

Today I presented at the ICANN DNSSEC workshop the potential results of DANISH working group which I think should include the entire scope having a mutual TLSA validated TLS session from an IoT device to a server.

https://github.com/CIRALabs/CIRA-Secure-IoT-Registry/blob/master/CIRA%20-%20Challenges%20in%20DNSSEC%20IoT%20Registry%20-%20ICANN%202021-6-14.pdf

In addition, I was thinking there should be a 4th TLSA certificate usage, type 0 or 4, for TLSA to show cert that are revoked, if we know for sure the certificate is revoked then it should be presented and queried/answered as such,  an authoritative answer signed with DNSSEC to say certificate is revoked, not to be trusted anymore.  NSEC says it does not exists, this usage would be very clear. This works for client identity, not sure for other TLSA use cases.

Jacques


IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.23.0 | Report a Bug | By Email