Re: [Dtls-iot] Hardware-based Random Number Generator

[Hannes Tschofenig <[e-mail]>]

I discussed this issue with my co-worker Thomas and here is the proposed
text change to address your issue:


------------------------

   IoT devices using TLS/DTLS must offer ways to generate quality random
   numbers.  There are various implementation choices for integrating a
   hardware-based random number generator into a product: an
   implementation inside the microcontroller itself is one option but
   also dedicated crypto-chips are reasonable choices.  The best choice
   will depend on various factors outside the scope of this document.
   Guidelines and requirements for random number generation can be found
   in RFC 4086 [RFC4086] and in the NIST Special Publication 800-90a
   [SP800-90A].


------------------------

Ciao
Hannes


On 07/15/2015 01:31 PM, Hannes Tschofenig wrote:
> Stephen wrote:
> 
> (10) 14: I want to check that the WG are really ok with the "MUST" for
> h/w "quality" RNGs. I really like the idea, but it's very odd for the
> IETF to have such a MUST touching on the style of implementation.  (Say
> if my entire implementation of TLS is in some kind of VM? Then I
> couldn't meet this ever.) I think we have to s/MUST/weasel-words/ there
> tbh, sadly - it's just not our job to mandate implementation styles. The
> following para though does the job nicely, so maybe s/MUST/ought
> to/ is enough of a change.
> 
> 
> In response to a similar comment from Russ I had softened the language
> already. Here is the remark that Russ had:
> http://www.ietf.org/mail-archive/web/dtls-iot/current/msg00273.html
> 
> I am, however, wondering whether we do ourselves a favour if we don't
> state what the requirements are.
> 
> The example you have mentioned is also a bit artifical since IoT devices
> don't run in a virtual machine and even virtual machines rely on
> hardware features from the underlying host operating system.
> 
> I hope someone in the group can share their views.
> 
> 
> 
> _______________________________________________
> dtls-iot mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>