Re: [Dtls-iot] IP Addresses in Certificates

[Stephen Farrell <[e-mail]>]

On 11/08/15 11:43, Hannes Tschofenig wrote:
> Hi Stephen,
> 
>> OTOH, there will be devices whose only visible identifier is an IP
>> address, right? If so, and if certificates/DTLS are to be of use with
>> such devices... then what? I do think some variety of "we" ought try
>> to address this problem.
> 
> I don't think that there are devices that have no other identifiers than
> IP addresses. For example, if a device has a network interface it will
> also have a MAC address. 

My hope is that 802 move more and more towards non-static or random
MAC addresses.

> There will also be an application sitting on
> top of the stack that might introduce identifiers.

Sure, they "might" :-) And if they do, then for sure there shouldn't
be any reason to put an IP address for such a device in a certificate.

My point is that there will be devices where the IP address is the
only reliably-present publicly (maybe public==on-LAN here) visible
identifier and where we'd like to use (D)TLS to talk to that device.
And we have no guidance for that case, and we do have a bunch of
gotchas and pitfalls.

> 
> Even beacons have identifiers (although they are not identifying
> individual devices themselves).
> 
> As a software / hardware engineer you will have to figure out what
> hardware components and what firmware you put on the device. As such, it
> is useful to think about these types of things early, which the document
> should be able to do.

Again, I'm not saying this document ought say what to do about
a certificate for 10.0.0.1. But again "we" probably should think
about that for some definition of "we" that is a subset of the
IETF I reckon. (Unless someone else has done a good job already
in which case that's fine.)

S.

> 
> Ciao
> Hannes
> 
> 
> 
> _______________________________________________
> dtls-iot mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>