IETF Logo Mail Archive

Re: [T2TRG] RESTful Design & Security

Hannes Tschofenig <hannes.tschofenig@gmx.net> Tue, 07 March 2017 19:10 UTC

Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: t2trg@ietfa.amsl.com
Delivered-To: t2trg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9713E1294A3 for <t2trg@ietfa.amsl.com>; Tue, 7 Mar 2017 11:10:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level:
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t5GshhWdQRma for <t2trg@ietfa.amsl.com>; Tue, 7 Mar 2017 11:10:46 -0800 (PST)
Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF73012949F for <T2TRG@irtf.org>; Tue, 7 Mar 2017 11:10:45 -0800 (PST)
Received: from [192.168.91.177] ([80.92.114.23]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0Ldq9D-1c2gDG2uWJ-00izTt; Tue, 07 Mar 2017 20:10:37 +0100
To: "Kovatsch, Matthias" <matthias.kovatsch@siemens.com>, "mcr+ietf@sandelman.ca" <mcr+ietf@sandelman.ca>
References: <c15a387f-9dd3-987e-2901-b86fd8f60108@gmx.net> <10144.1488908366@obiwan.sandelman.ca> <952c4a16-174f-2457-1f11-8f733e738f90@gmx.net> <4EBB3DDD0FBF694CA2A87838DF129B3C01AA2F98@DEFTHW99EL4MSX.ww902.siemens.net>
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9
Message-ID: <558bae1a-ff84-9fb3-c6bf-021f492e9a04@gmx.net>
Date: Tue, 07 Mar 2017 20:10:35 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0
MIME-Version: 1.0
In-Reply-To: <4EBB3DDD0FBF694CA2A87838DF129B3C01AA2F98@DEFTHW99EL4MSX.ww902.siemens.net>
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="HcQKe5NSPefaEL118SR6hSrQGnxMWLPj0"
X-Provags-ID: V03:K0:mtTGy1MnFfbSlgWATxzXXoNndXiYB8NUDW4UeXBGCLd3/7u1gAU KcsWTD6NArTIdjl8hrPmdfsEP/oaEuIdGQrb68gIQCfJ1xCz4bGgxtQhuqGfikeM67xPjVw J2XqctPIhCZhtqj5VSZZas79qWSScNxBdPPxXV93BqFn5d3OoKA55vgOkeO0k8ZETw4TNhX NQXIBEqmPizHfP4t5e9Iw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:EH+YFw2RbgQ=:mDo+V6bQWm77VZDphfh/LN 7qHz7/n4ICLvFhP0t2PYYeHnA3VcWajJdRdDLZyj9obaTTlji73mqDetupilvRzOeKGhkXn3M NYDlKyOCx5O9kzHQEsGLLdumNEtZZzzYzSRLQlH++pzO5tLBmkQj5ark7dz/HNz3WNiC9kd7b IwyaJhqhKjdn7fzM+9rLa3HSnpycvc8SHfB8g4AzlO1raXVZq2mHGmd4dlWElBkKdSDBUQPbM 3dvds7Fcu7lz2CR0HG6+sKDafTo7A8i2m/EqdBrgyQTvD3t/aIF1o5tZbkj9/T2dngZwOlbLf ZvdIUBEcE1sN+B5p7R6e+9pJymbV17B0GFJCQP02cnWGYCVgOAR0A2lABfHnIG0HspITOh+EX msina14c5okNM/ICLEUfFJhlg8eVWSvfzgzh8pwO70M9n8FERhjbSEnjOIFBoHbYSNYDAdt2A WT86KD9y5kk9kvH2GDaehNwSF8d+8/3PBeK1j6SWBc2TcRMKpEQ997ro+/TfC6d4A/bMQb+4W 3oGbRVmPHNVMJWbvacvh8Xb1HVhInFJjMf1zY71wpLLJwu1DGYWDEsvmH38OojLQ6e+gY9bVA eU1chXuoBGDKGkSvuthmRkQRiyWX8KWGZiljdEKmJDqU6GB+Fzf5FVbSr1nzM34tMwjnoyaFr iC8oJW8jKGM1qYc/xusu5eE1EbuZBh3/v26DaForfEs2MoSJzqoPZ17RnpXrnnyAi+Y6Ww+QY yxezTAQBxWMtix1+bG18IWdhKSeXrCMtEwu4va8iVKnIO5bFD+fWBzQAO3Q=
Archived-At: <https://mailarchive.ietf.org/arch/msg/t2trg/D4W63735rlfrtDmNUm-Nw4-bIaY>
Cc: "T2TRG@irtf.org" <T2TRG@irtf.org>
Subject: Re: [T2TRG] RESTful Design & Security
X-BeenThere: t2trg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "IRTF Thing-to-Thing \(T2T\) Research-Group-in-creation" <t2trg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/t2trg>, <mailto:t2trg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/t2trg/>
List-Post: <mailto:t2trg@irtf.org>
List-Help: <mailto:t2trg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/t2trg>, <mailto:t2trg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Mar 2017 19:10:47 -0000

Hi Matthias,

I know that this is a research group and everyone can create whatever
they want.

We briefly talked about security at the IoT directorate conference call
and I would be interesting to hear what works and what does not work for
others.

Ciao
Hannes


On 03/07/2017 07:45 PM, Kovatsch, Matthias wrote:
> On big propaganda tour? :P
> 
> Regards
> Matthias
> 
> 
> Sent from my phone, limitations might apply.
> 
> -----Original Message-----
> *From:* Hannes Tschofenig [hannes.tschofenig@gmx.net]
> *Received:* Tuesday, 07 Mar 2017, 19:39
> *To:* Michael Richardson [mcr+ietf@sandelman.ca]
> *CC:* t2trg@irtf.org [T2TRG@irtf.org]
> *Subject:* Re: [T2TRG] RESTful Design & Security
> 
> OSCOAP does not work when
> 
> * you mix protocols,
> * use a middlebox for some processing interactions (such as data
> aggregation), and
> * when one of the protocols is a non-RESTful protocol, such as BLE or MQTT.
> 
> Unfortunately, these the use cases we are facing in current IoT
> deployments. For similar reasons we cannot use RFC 8075 either.
> 
> Maybe you are seeing different deployment environments.
> 
> Ciao
> Hannes
> 
> On 03/07/2017 06:39 PM, Michael Richardson wrote:
>> 
>> Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
>>     > Needless to say that these challenges have also been observed in other
>>     > protocols as well, such as HTTP and even SIP.
>> 
>>     > What is the story for providing application layer security?
>> 
>> OSCOAP seems to be end-to-end to me.
>> 
>> --
>> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>>  -= IPv6 IoT consulting =-
>> 
>> 
>> 
> 
> 
> 
> _______________________________________________
> T2TRG mailing list
> T2TRG@irtf.org
> https://www.irtf.org/mailman/listinfo/t2trg
>

v2.23.0 | Report a Bug | By Email