Re: [Iot-directorate] Iotdir last call review of draft-ietf-drip-arch-22
shuai zhao <shuai.zhao@ieee.org> Wed, 11 May 2022 23:58 UTC
Return-Path: <shuai.zhao@ieee.org>
X-Original-To: iot-directorate@ietfa.amsl.com
Delivered-To: iot-directorate@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3E39C1594B2 for <iot-directorate@ietfa.amsl.com>; Wed, 11 May 2022 16:58:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.569
X-Spam-Level:
X-Spam-Status: No, score=-2.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.575, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTP_ESCAPED_HOST=0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ieee.org
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gstuoikFR3HZ for <iot-directorate@ietfa.amsl.com>; Wed, 11 May 2022 16:58:32 -0700 (PDT)
Received: from mail-oi1-x231.google.com (mail-oi1-x231.google.com [IPv6:2607:f8b0:4864:20::231]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAB52C15E419 for <iot-directorate@ietf.org>; Wed, 11 May 2022 16:58:32 -0700 (PDT)
Received: by mail-oi1-x231.google.com with SMTP id m25so4597765oih.2 for <iot-directorate@ietf.org>; Wed, 11 May 2022 16:58:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=from:to:cc:subject:thread-topic:thread-index:date:message-id :references:in-reply-to:accept-language:content-language :mime-version; bh=ZjsHQNIw6Cj1LHAxDRxsrYnrvZOj5w85IDghSQhdwm4=; b=hDq0J/HWgDjIbAlBvxUGMSA6KXvj7pVaG7Ri5WVLnTeQmYPTL+/t0B2ZrVBY4sKeZQ AvFxE53H3BO99yGRQNl6+yNvziCrwhry/ixr0OZlcTfgiqCPyrVZK39RTwXgJJe31dRU WffMtD/1sEn9MKfPP2p3Yw4lCotFcpo9OwG8c=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:thread-topic:thread-index :date:message-id:references:in-reply-to:accept-language :content-language:mime-version; bh=ZjsHQNIw6Cj1LHAxDRxsrYnrvZOj5w85IDghSQhdwm4=; b=wkopWgGvqXknZMBSxw1ECKOo6Ne4tCgP89ftBMZMX04affMGbczap+EYAKZxp8HWWr sNZXUjHSEo+WwGHtuTMZmqlXYCCwt5e45SP0JEEYPbrijBAzsR6KpKkjiT9eA/PyAVBk N7EDxzlEB5l3h+CUtLmjvMgM8azcKrTskZvCp2zYGQ7kFLvXHP+Nnotb+fBzuJhunJYZ mPFVgcj+y84dc2AAU1mlMCP0Lfn7bNarsM1wvfG/IK8YRZK1U7CfmBV0K+XuW6EK656c yEIK90SCh/l3DcqxhaaYOMvP4YD3c1jqgLpfg/iNSbeGqfCT8u2hSmAjsqsMqLLK/d9x uzaQ==
X-Gm-Message-State: AOAM532/ggVOve+F9ESQ5ledSrx05JJN3bS4eA9YaSJ74gtk4YAjDnuZ k/PjeWLH5rVvf3ypvCd2qQsQsA==
X-Google-Smtp-Source: ABdhPJx+2UQamSbIVUOGvPfAHaVXSGOPNA6oIQWB6lixe2o6HDa+vOo3UWt+jvREQOzXfHDmqxzx8Q==
X-Received: by 2002:a05:6808:f0b:b0:328:bad3:2d92 with SMTP id m11-20020a0568080f0b00b00328bad32d92mr1493002oiw.277.1652313510971; Wed, 11 May 2022 16:58:30 -0700 (PDT)
Received: from PH0PR17MB5728.namprd17.prod.outlook.com ([52.96.186.37]) by smtp.gmail.com with ESMTPSA id j10-20020a54480a000000b00325cf57766bsm1250600oij.1.2022.05.11.16.58.29 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 11 May 2022 16:58:30 -0700 (PDT)
From: shuai zhao <shuai.zhao@ieee.org>
To: Thomas Fossati <thomas.fossati@arm.com>, "Stuart W. Card" <stu.card@axenterprize.com>, Robert Moskowitz <rgm@htt-consult.com>, "adam.wiethuechter@axenterprize.com" <Adam.Wiethuechter@axenterprize.com>
CC: "draft-ietf-drip-arch.all@ietf.org" <draft-ietf-drip-arch.all@ietf.org>, "last-call@ietf.org" <last-call@ietf.org>, "tm-rid@ietf.org" <tm-rid@ietf.org>, "iot-directorate@ietf.org" <iot-directorate@ietf.org>
Thread-Topic: Iotdir last call review of draft-ietf-drip-arch-22
Thread-Index: ATM0NDYwM2CPvirZ2UdqWVYZFpSrTMpiuD2L
X-MS-Exchange-MessageSentRepresentingType: 1
Date: Wed, 11 May 2022 23:58:27 +0000
Message-ID: <PH0PR17MB57286B4B892B06893ACDCFC6F4C89@PH0PR17MB5728.namprd17.prod.outlook.com>
References: <164840309027.4996.16025423500440919013@ietfa.amsl.com>
In-Reply-To: <164840309027.4996.16025423500440919013@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator:
X-MS-Exchange-Organization-RecordReviewCfmType: 0
Content-Type: multipart/alternative; boundary="_000_PH0PR17MB57286B4B892B06893ACDCFC6F4C89PH0PR17MB5728namp_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/iot-directorate/6KFndpoupbPD7b09mulzUZhw7UU>
Subject: Re: [Iot-directorate] Iotdir last call review of draft-ietf-drip-arch-22
X-BeenThere: iot-directorate@ietf.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: Mailing list for the IoT Directorate Members <iot-directorate.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/iot-directorate>, <mailto:iot-directorate-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/iot-directorate/>
List-Post: <mailto:iot-directorate@ietf.org>
List-Help: <mailto:iot-directorate-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/iot-directorate>, <mailto:iot-directorate-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 May 2022 23:58:37 -0000
Hi Thomas, We had a Github issue tracker<Github%20issue%20tracker> for your comment, It seems like co-authors are reaching some agreement. Please see reply inline below. Best, Shuai From: Thomas Fossati via Datatracker <noreply@ietf.org> Date: Sunday, March 27, 2022 at 10:44 AM To: iot-directorate@ietf.org <iot-directorate@ietf.org> Cc: draft-ietf-drip-arch.all@ietf.org <draft-ietf-drip-arch.all@ietf.org>, last-call@ietf.org <last-call@ietf.org>, tm-rid@ietf.org <tm-rid@ietf.org> Subject: Iotdir last call review of draft-ietf-drip-arch-22 Reviewer: Thomas Fossati Review result: Ready with Issues This is a great document and fun to read. Thank you authors! I have tried to highlight a few small things that could be articulated a bit more from an IoT perspective but overall I have no major concerns with it, except a tangential thing around the document intended status (see "Issues" below.) # Issues * The charter says: "the WG will propose a standard document that describes the architecture […]" but the status is informational. I am pretty sure informational should be appropriate, but highlighting a potential disconnect. Shuai/ Please see Med’s reply thread on March 27th. # Comments * In some IETF circles (e.g., RATS & TEEP) "attestation" has a precise meaning, which is quite distinct from the DRIP definition "[…] normally used when an entity asserts a relationship with another entity". Specifically, unless the signing key is derived from the measured boot state (a la DICE), or the claims are of a certain kind, the process that this doc names "attestation" is not what is meant usually. => Maybe add a few words to Section 2.2 to clarify the distinction between DRIP attestation and RATS's, e.g., by adding a disclaimer similar to that already associated with DRIP certs. * Apropos "remote attestation", I am wondering whether, given the type of endpoints considered in the architecture - and in particular provided their increased exposure to physical compromise, and the potentially large impact on the overall system and beyond - the architecture should provide explicit channels for securely conveying the verification of the installed and booted firmware (as well as any other relevant trust metrics)? * I haven't read the rest of the DRIP docs, so I am not sure why is EdDSA specifically mentioned in Section 3.2.? Is this a requirement or just an example? I guess the latter, but checking just in case. And apropos that, in light of fault attacks on deterministic ECDSA and EdDSA [0] that are potentially easier to carry out against UAs (BTW, how cool is a fault attack w/ private key exfiltration carried out by a chasing drone?) maybe it's worth adding to the security considerations some words around physical attacks and their impact on the choice of signature algorithms? Bob/ WRT to use of EdDSA: Only EdDSA provides 32 byte public keys. This is essential in the Authentication Messages defined in draft-ietf-drip-auth. With ECDSA, you have to use public key compression to get 32 byte keys which then poises the issue with patents. Thus EdDSA is the 1st defined PK algorithm. There may be more down the road of deployment. Experience will drive this. Also at some future point a PQC solution may be developed that will work within this environment and will then be added. * It'd seem that, given the very low bandwidth, DoS (as well as Denial of View) attacks on communication involving the UA should be quite easy to mount? Maybe worth spending some words on the argument to describe what the threats are and which mitigations are available. Bob/ The USA FAA and other CAAs have mandated Broadcast RID over Bluetooth and WiFi. Any DOS attacks against these RF are basically out of scope. It will happen and the ground observer will not get the messages. So we have left DOS over RF as nothing worth saying about it. I will say that this is sometimes brought up as an argument FOR autonomous operations. You don't want to be forced to land your UA just because of a RF DOS attack; you have a delivery to make. * This is a question more than anything else: given the constrained nature of UAs, I was wondering whether it is envisaged that the end-to-end network path will be realised with the use of more capable (trusted) proxy nodes? If so, there may be a few security and privacy considerations to be added. Bob/ This only comes into play with Network Remote ID and Command and Control. The first draft for this is still a little drafty (draft-moskowitz-secure-nrid-c2) so the architecture doc is thin on this discussion. Much of it will be what wireless tech will be used. Proxying NRID is only applicable for UA in LOS operation. BLOS will require the a WAN wireless. If LoRaWAN works (might be too much traffic for it, TBD), then there will naturally be a LoRaWAN proxy. But we are only started down the NRID path for a non-proprietary solution. # Nits * AAA is usually intended as "Authentication, Authorization, and Accounting" (see also [1]), whereas here it's got four new A's: Attestation, Access Control , Attribution, Audit :-) => Maybe change it to 7A, A7, AAA+ or similar? Shuai/ Co-authors and Chairs prefer to keep it as “AAA” to be consistent with DRIP requirement RFC9153. * In Section 2.1, the following terms are already in the most recent "RFC Editor Abbreviations List" [1] and can be removed: * EdDSA * HIP * HIT * HI Shuai/ I would suggest we don't remove that. I recall that were discussions to add those terms in section 2.1 during WGLC * Some typographic inconsistency around Bluetooth: Is it 4 or 4.x? 5 or 5.x? => Stick to one format. (Also maybe add an explicit reference to the Bluetooth specs.) Shuai/ Bob prefers “only 4.x and 5.x in first use. Then only 4 and 5. [0] https://eprint.iacr.org/2020/803 [1] https://www.rfc-editor.org/materials/abbrev.expansion.txt Shuai/ I assume we agree not to add above references and just refer to ASTM document.
- [Iot-directorate] Iotdir last call review of draf… Thomas Fossati via Datatracker
- Re: [Iot-directorate] Iotdir last call review of … mohamed.boucadair
- Re: [Iot-directorate] Iotdir last call review of … Stuart W. Card
- Re: [Iot-directorate] Iotdir last call review of … Thomas Fossati
- Re: [Iot-directorate] [Drip] Iotdir last call rev… Robert Moskowitz
- Re: [Iot-directorate] Iotdir last call review of … shuai zhao
- Re: [Iot-directorate] Iotdir last call review of … Thomas Fossati