Re: [Dots] Questions about draft-moskowitz-dots-identities-00

[Robert Moskowitz <[e-mail]>]

I had limited time and thought organization to 'get it all down' and 
still working.

Almost regardless of the security mechanism used for DOTS transport(s), 
identities are crucial and called out in the requirements draft for 
'mutual authentication'  (I would have to pull up the draft.  I will add 
a section on this on identities-01). So what are the identities used for 
mutual authentication?

X.509 certs are often used for this, but how does a machine acquire its 
cert?  A very involved and painful human controlled process or something 
better?  IEEE 802.1AR lays the groundwork for device identities.  ANIMA 
and NETCONF are working on leveraging this.  I have spoken with Max and 
others, and have my thoughts on how to do close to a 'zerotouch' for 
certificates in DOTS agents.

As to RawPublicKeys, it again comes down to the security protocol. DTLS 
with CoAP particularly uses RawPublicKeys.  Or there is HIP/ESP or other 
work I am doing where HITs can fit the bill.

So I am laying out here how identities are setup.  I will send you my 
transport thoughts that have been going between Frank, Sue Hares, and me 
shortly.

On 11/11/2016 01:29 PM, Roman D. Danyliw wrote:
>
> Hello Bob, Frank, Daniel and Andrew!
>
> Thanks for producing and submitting this draft!
>
> (chair hat off)
>
> The document lays out the a strong case in Section 1 about why in the 
> abstract human readable names have problems.  Section 1.1 and 1.2 
> highlight alternatives.  However, I’m having difficulty linking these 
> approaches with specific applications in a particular DOTS protocol 
> draft. Can you share a bit more of what you had in mind in applying 
> 802.1AR or RFC7401?
>
> Thanks,
>
> Roman
>