Re: [Iot-onboarding] EduRoam for IoT

Hi Mohit:

I fully agree with your e-mail.

Some other comments inline.

> El 11 dic 2019, a las 11:03, Mohit Sethi M <mohit.m.sethi=40ericsson.com@dmarc.ietf.org> escribió:
> 
> Hi Michael,
> 
> On 12/10/19 5:01 PM, Michael Richardson wrote:
>> sandoche Balakrichenan <sandoche.balakrichenan@afnic.fr> <mailto:sandoche.balakrichenan@afnic.fr> wrote:
>>     >> I don't think that it is network onboarding, but application onboarding that
>>     >> is desired.
>>     >>
>>     > ==> Application onboarding is for the LoRaWAN scenario.
>> 
>>     > Don't we have the need for network onboarding for other IoT networks?
>> 
>>     > The objective is to come with a generic solution, if possible.
>> 
>> Then, I think that you want a BRSKI based system, if you want to address a
>> large number of context.  I am skeptical that this can include LoRA.
> I would like to understand the reasoning behind this statement. 
> 
I would like to understand it as well. As a note, we already tested and got some experimental results using CoAP-EAP (with EAP-PSK as proof-of-concept but any other method can be used, such as EAP-NOOB, EAP-AKA’, etc...). 

Please refer to: https://www.mdpi.com/1424-8220/17/11/2646 
> I believe that EAP is better suited for a large number of contexts:
> 
> - There are more than 52 methods to choose from. Depending on the type of credentials, you can choose from: certificates (EAP-TLS), PSK (EAP-PSK or EAP-TLS-PSK that John, Owen, and I plan to work on), one-time-password (EAP-POTP), password (EAP-pwd), SIM cards (EAP-AKA`) and so on. You can even combine different credentials such as certificates for the outer tunnel and passwords inside (EAP-PEAP/EAP-FAST/EAP-TEAP). 
> - EAP standard has been around for over a decade and is stable. 
> - Several implementations exist (including a few open source).
> - Roaming and federation is natively supported in the EAP architecture. It has been widely deployed and tested (eg. eduroam). 
> - Can work a variety of lower-layers such as UDP (PANA), IEEE 802.11 (EAPOL), CoAP (with CoAP-EAP:https://tools.ietf.org/html/draft-marin-ace-wg-coap-eap-06 <https://tools.ietf.org/html/draft-marin-ace-wg-coap-eap-06>)
> 
This summary is great. +1

Best Regards.

> I gave a cursory look at BRSKI draft the and found references to unauthenticated TLS, TCP, CoAP, HTTP, CDDL. I am certainly not one of those folks who would use the excuse of small devices or limited bandwidth for poor security (see section 9 of RFC 8387 https://tools.ietf.org/html/rfc8387#section-9 <https://tools.ietf.org/html/rfc8387#section-9>). However, this seems a bit excessive (at least for Sandoche but probably for many others). 
> 
> --Mohit
> 
>> 
>> --
>> ]               Never tell me the odds!                 | ipv6 mesh networks [
>> ]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
>> ]     mcr@sandelman.ca <mailto:mcr@sandelman.ca>  http://www.sandelman.ca/ <http://www.sandelman.ca/>        |   ruby on rails    [
>> 
>> 
>> 
> -- 
> Iot-onboarding mailing list
> Iot-onboarding@ietf.org
> https://www.ietf.org/mailman/listinfo/iot-onboarding

-------------------------------------------------------
Rafa Marin-Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------