Re: [Secdispatch] EDHOC Summary

[Hannes Tschofenig <[e-mail]>]

Hi Goeran,


Hi Hannes,

On 2019-04-18, 13:01, "Hannes Tschofenig" <[e-mail]> wrote:

    Hi Goeran,

     [GS] The AKE for OSCORE clearly must support the same transport as OSCORE.

    No, it doesn't.

[GS] Strike "clearly", this is a requirement coming from use cases implementing OSCORE and in need for an AKE.

[Hannes] I don't see where this requirement comes from. From the DTLS/TLS experience I have seen several solutions in the IETF where the handshake was separate from the protection of the data.
It wasn't a problem there...

I actually see advantages if we untangle it from the transport because we keep inventing new transports. FWIW I see QUIC as a new transport as well and one that has not been explored enough in the IoT space.

    > From first individual submission to the approved version of OSCORE, the introduction section states that OSCORE may or may not be used over TLS/DTLS.
    > (The approved version recommends the use of additional TLS for certain hops, but not over constrained networks.)
    You see what I am talking about...

[GS] No.

[Hannes] First you say "it may be used over TLS/DTLS" even in the draft. Later, you add that it shouldn't be done over constrained networks. I am sure I can dig out meeting meetings where you deny that OSCORE/EDHOC are in any competition to TLS/DTLS.


    > OSCORE/AKE over TLS is similar to TLS over IPsec/IKEv2.
    You know that nobody uses IPsec / IKEv2 in an IoT context (even though some of your co-workers even argued for it some time ago).

[GS] The analogy I wanted to make is that security protocols may be applied at multiple layers on a particular leg of a communication path.
This has nothing to do with IoT context.

[Hannes] But it was a good example because back then I was also the only one voicing concerns about the large number of security options we provide in the IoT space. It seems that you agree with me in the meanwhile. More options does not necessarily lead to better interoperability.

Ciao
Hannes


Göran



IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.