Re: [T2TRG] review of draft-irtf-t2trg-iot-seccons

[Stephen Farrell <[e-mail]>]

Hiya,

On 22/02/18 12:08, Eliot Lear wrote:
> Hi Stephen,
> 
> 
> On 22.02.18 12:05, Stephen Farrell wrote:
>> I still think the RG should consider whether to make a strong
>> recommendation that devices that are incapable of verifying a
>> reasonable signature are really highly likely to cause trouble.
>> IOW, couldn't the RG RECOMMEND that such devices ought not be
>> even indirectly exposed to the Internet, given the real-world
>> threats faced? If the RG did have consensus on that, then that
>> would I think help those developing standards and subsequent
>> users of devices built to those standards.
> 
> I think this depends on just how connected we are talking about. Where
> does one draw the line?  Surely we have seen Bluetooth exploits, for
> example.  What about serial devices?  Does an actuator that takes a
> simple +/- count?  To put this into some context, let's talk about
> automotive vulnerabilities.  A classic way into a car is via the 3G
> interface in the entertainment system, but an equally possible way in,
> as Cantor et al demonstrated was via the diagnostic port.  Should a
> brake actuator require authentication on the CAM?  How many ms do you
> get or how many mw can you spend on the op before it impacts the
> distance an electric vehicle can travel before its next charge?  A
> careful drawing of the line is in order for any such recommendation, and
> the parameters of that recommendation are worthy of exploration.

I agree that any "baseline" crypto capability recommendation
would need such exploration and justification. OTOH, we do
kinda know that s/w update pretty much needs signatures, which
is why I suggest that the ability to verify some signatures
at some time(s) could be a good baseline capability to consider.
(That's not to suggest that all inbound messages to all devices
be signed, as that'd not be a good plan:-)

What I'm suggesting is that the RG do the exercise of trying
to see if such a baseline could be usefully described. (And as
I'm not on the RG list, it could be that that's been discussed,
but if so, that's not visible in this draft.)

Cheers,
S.