Re: [Dtls-iot] Further analysis of the problem space and security - flexibility - ease of use - cost considerations (Fwd: DTLS multicast security)

[Carsten Bormann <[e-mail]>]

On 03 Oct 2014, at 21:01, Michael StJohns <[e-mail]> wrote:

> What I think we got was consensus that symmetric key multicast control wasn't going to fly and that symmetric key multicast confidentiality might be useful.

Control is not a security service.
I don’t think there is consensus that group authentication is not useful.
In any case, it is hard to do confidentiality without some form of authentication.

I live in a world where the loudly stated arguments about group authentication being dangerous and asymmetric crypto being “cheap" just don’t apply.  Apparently, I have been unable to show some of you this world.  I just spent another two days in a workshop on systems and products where this is so patently obvious that words escape me.  So I don’t think we can have consensus between the IoT security view and the loudly stated military/banking security view here.

draft-mglt-dice-ipsec-for-application-payload-00 demonstrates that existing IETF standards track protocols suffice to solve the problem at hand, except maybe for a lack of optimization.  So maybe this is where those interested in solving this problem need to continue their work.

Grüße, Carsten