Re: [Dtls-iot] Secure Time (again)

[Michael StJohns <[e-mail]>]

On 8/11/2015 10:46 AM, Hannes Tschofenig wrote:
> A possible alternative is to do it like the Kerberos folks did it,
> namely by adding it to the key distribution mechanism (which would then
> be ACE).

TANSTAFFL - there ain't no such thing as a free lunch.

I don't believe that "secure" time is possible without persistent time 
and that's difficult to do for cheap battery operated IOT nodes (or so 
I've been told).  The best you can do is generally "tell me N times" 
similar to NTP and hope you're part of the mesh hasn't been captured by 
bad data.

There's also the tradeoff between precision and accuracy that needs to 
be considered.  IOT nodes with cheap clock circuitry will drift. If you 
want millisecond precision and 1 part per billion accuracy you're going 
to be disappointed (note that I didn't do the math - I may have meant 
1PPTrillion or 1PPMillion).

Then there's the whole latency thing - you might get a signed time 
object from Kerberos, but that object may have been sent a week ago.  If 
you have no persistent time and you're just coming up..... welcome to 
last week.

I think any system on the mesh is going to require something like NTPs 
tell me N times to work.  I don't think that NTP is a drop in fix though.

Time is not a simple thing.  Secure time is frankly arcane and not meant 
for mere mortals to delve into.  :-)

I'm wondering if it might not be a bad idea to invite Dave Mills to come 
to an IETF to do a presentation on secure mesh time and give us his 
thoughts.

Mike


>
>
> On 08/11/2015 04:44 PM, Ludwig Seitz wrote:
>> If falling back to NTP means additional traffic (which I strongly
>> suspect) this is not a god thing in the IoT world. The attraction of
>> using DTLS/TLS is that you can piggyback the information in the
>> handshake (that you have to do anyways).
>>
>> So is there an alternative? Could we use RFC4680?
>
>
> _______________________________________________
> dtls-iot mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtls-iot