Re: [Danish] Proposed WG Charter

Sorry, meant to reply to the list.

On Mon, Jun 14, 2021 at 2:05 PM Ash Wilson <ash.wilson@valimail.com> wrote:

> Hi Paul,
>
> Very often, mobile data used for IoT ends up going into a message broker
> or message queueing system, and the central application subscribes or
> otherwise consumes information from the messaging middleware. Without some
> sort of verifiable sender identity attached to the message itself, the
> identity of the sender and the integrity of the message is assumed based on
> the integrity of all middleware involved in passing messages. If we include
> the sender's DNS name in the message and protect it with a signature, then
> it may be verified by the central application, independent of the transport
> over which it arrives. Then, mobile data network authentication becomes
> more about protecting availability and performance than preventing
> impersonation in a message-oriented application. Use cases centering around
> mobile network identities are a little more nuanced, and the available
> mechanisms can vary based on the mobile operator's tech stack. That's
> probably a better conversation for 3GPP.
>
> Consider that if a messaging middleware platform is trusted by multiple
> sophisticated smart cities applications, and none of those applications
> implement message authentication, the messaging middleware platform itself
> becomes an attractive target for a well-resourced adversary. Simply signing
> the messages passing through the system removes the pressure on the broker
> to ensure integrity, and reduces the value of a compromised broker.
>
> On Sun, Jun 13, 2021 at 3:22 PM Paul Wouters <paul@nohats.ca> wrote:
>
>> On Jun 13, 2021, at 16:52, Viktor Dukhovni <ietf-dane@dukhovni.org>
>> wrote:
>> >
>> > On Sat, Jun 12, 2021 at 08:25:07AM -0700, Ash Wilson wrote:
>> >
>> >> This is the final text for the proposed charter. We are seeking
>> >> support for the formation of the working group, as well as support for
>> >> implementation, adoption, and documentation efforts.
>> >
>> > I see that others have commented positively on the charter, and yet
>> > somehow for me it seems rather muddled.  It is not clear to me what
>> > the motivating use-cases really are, nor how DANISH would resolve
>> > the key difficulties in those use-cases.
>>
>> Same here. I did give feedback in the past already but especially the
>> “client verification with and without dnssec” seem to be two widely
>> different problems. And the one without dnssec (webpki) already exists ?
>>
>> > Extending DANE to client auth is certainly an option for "devices" that
>> > one might reasonably want to register in DNS.
>>
>> I have given this some thought in the last few weeks and I haven’t been
>> able to find a use case where one actually wants client authentication
>> using some IoT device on mobile data network. All use cases I can think of
>> would not want to expose the client via public dnssec key registry or via
>> public CA certs. I’d love to hear an example practical use case for DANISH.
>>
>> Paul
>> --
>> Danish mailing list
>> Danish@ietf.org
>> https://www.ietf.org/mailman/listinfo/danish
>>
>
>
> --
>
> *Ash Wilson* | Technical Director
> *e:* ash.wilson@valimail.com
>
> This email and all data transmitted with it contains confidential and/or
> proprietary information intended solely for the use of individual(s)
> authorized to receive it. If you are not an intended and authorized
> recipient you are hereby notified of any use, disclosure, copying or
> distribution of the information included in this transmission is prohibited
> and may be unlawful. Please immediately notify the sender by replying to
> this email and then delete it from your system.
>

-- 

*Ash Wilson* | Technical Director
*e:* ash.wilson@valimail.com

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.