Re: [Dtls-iot] IP Addresses in Certificates

Hiya,

On 05/08/15 15:54, Hannes Tschofenig wrote:
> Hi Stephen,
> reading through this issue again I believe you could help us further explain 
> what we could recommend in the document.

Assuming that it'd be a bunch of work to recommend how to best
handle certificates for devices that will only ever have a bogon
IP address, I guess the best for now is to just say that that work
is not (yet) done and hence this document makes no recommendation.

Seem ok? (And yes it could be that the current text on that
is just fine, I didn't go look back right now)

S.

> Currently, we are saying that folks shouldn't use IP addresses in certificates 
> and in the email below Thomas mentioned one reason for doing so. I also pointed 
> to a separate draft we have been working on to explore the topic further (see 
> <draft-fossati-core-certmode-rd-names-01>).
> Ciao
> Hannes
> *Gesendet:* Dienstag, 21. Juli 2015 um 14:16 Uhr
> *Von:* "FOSSATI, Thomas (Thomas)" <thomas.fossati@alcatel-lucent.com>
> *An:* "Stephen Farrell" <stephen.farrell@cs.tcd.ie>, "Hannes Tschofenig" 
> <hannes.tschofenig@gmx.net>, "dtls-iot@ietf.org" <dtls-iot@ietf.org>
> *Betreff:* Re: [Dtls-iot] IP Addresses in Certificates
> Hi Stephen,
> 
> On 15/07/2015 12:20, "dtls-iot on behalf of Stephen Farrell"
> <dtls-iot-bounces@ietf.org on behalf of stephen.farrell@cs.tcd.ie> wrote:
>  >Hiya,
>  >
>  >On 15/07/15 12:07, Hannes Tschofenig wrote:
>  >> Stephen wrote:
>  >>
>  >> (5) 6.3: Forgetting CoAP for the moment, surely this profile will be
>  >> used with devices that only have (possibly bogon) IP addresses and that
>  >> want to have those in certs. I do get that how to handle that well is
>  >> not very clear, esp. for certs for e.g. 192.168.0.1, but shouldn't it
>  >> really be covered by this profile?
>  >
>  >I should also have mentioned link-local addresses too I guess.
> 
> v6 link-local make sense as stable identifiers, but they'd be equivalent
> to EUI-64 (which is what 6.3.2 requires for the use case where all the
> secure communication happens on the same subnet), only a few bytes larger
> than their EUI counterpart.
> 
> Other kinds of IP addresses aren't long-term/stable enough to be put in a
> certificate -- which is in line with the recommendation we give in CoAP
> [https://tools.ietf.org/html/rfc7252#section-9.1.3.3].
> 
> Cheers, t
> 
> _______________________________________________
> dtls-iot mailing list
> dtls-iot@ietf.org
> https://www.ietf.org/mailman/listinfo/dtls-iot
> 