Re: [Dtls-iot] IP Addresses in Certificates

[Hannes Tschofenig <[e-mail]>]

Hi Stephen,


On 08/11/2015 12:50 PM, Stephen Farrell wrote:
> 
> 
> On 11/08/15 11:43, Hannes Tschofenig wrote:
>> Hi Stephen,
>>
>>> OTOH, there will be devices whose only visible identifier is an IP
>>> address, right? If so, and if certificates/DTLS are to be of use with
>>> such devices... then what? I do think some variety of "we" ought try
>>> to address this problem.
>>
>> I don't think that there are devices that have no other identifiers than
>> IP addresses. For example, if a device has a network interface it will
>> also have a MAC address. 
> 
> My hope is that 802 move more and more towards non-static or random
> MAC addresses.

Me too but then we (in the IETF) just replace it with something static
at the IP layer (as we managed to remove the randomized IPv6 interface
generation via 6lo....).

> 
>> There will also be an application sitting on
>> top of the stack that might introduce identifiers.
> 
> Sure, they "might" :-) And if they do, then for sure there shouldn't
> be any reason to put an IP address for such a device in a certificate.
> 
> My point is that there will be devices where the IP address is the
> only reliably-present publicly (maybe public==on-LAN here) visible
> identifier and where we'd like to use (D)TLS to talk to that device.
> And we have no guidance for that case, and we do have a bunch of
> gotchas and pitfalls.

Here is the additional challenges:
1) When are the certificates generated?
2) When are the IP address assignment happens?

If the certificates are generated during the manufacturing time then the
IP address cannot be know. So, what IP address are you going to put in
there?

May I assume that the certificate enrolment request is done using some
protocol during the deployment (such as with EST) then the IoT devices
provides the currently assigned IP address to the enrolment server to
get the certificate back?

Would this mean that every time the IoT device gets a new IP address it
has to request a new certificate?

If not, would we just assume that the IP address in the certificate has
no relationship to what is contained in the certificate?

If we talk about IPv6 addresses why wouldn't we just put the IID into
the certificate rather than the full IP address (assuming that the IID
does not change for certain deployments)?

Ciao
Hannes