[T2TRG] Quick Doodle T2TRG security topics (Re: New topic for T2TRG?)

[Carsten Bormann <[e-mail]>]

I assume most people are mostly in holiday mode already.
We did want to have a chat this year about setting up a T2TRG activity around research issues in securing IoT (tentatively called “seccore”), similar to WISHI, but probably with a different core group of people attending.
Some background for that in Göran's mail cited below.

I have put up 9 potential meeting slots this week:
https://doodle.com/poll/7e76k335hd6d28k3

If you are interested, please choose slots you can still make.
I plan to close this COB US today, so please click quickly.

This week’s meeting is mostly for planning and, first and foremost, discussing the scope we want to communicate.
The actual first meeting of a seccore activity would probably then be in 2022W2, but that is one of the things we want to discuss this week.

That link was https://doodle.com/poll/7e76k335hd6d28k3 ...

Grüße, Carsten


> On 2021-11-29, at 17:15, Göran Selander <[e-mail]> wrote:
> 
> Dear T2TRG,
>  
> As reported from the CoRE applications side meeting below, there seems to be an interest in progressing topics in the area of security for constrained RESTful environments, and a proposal to host that work in T2TRG.
>  
> * What?
>  
> CoAP can be used in various settings beyond simple REST. How do we adapt existing security requirements and solutions to these new modes of operation? Some work of this kind is already in progress in the IETF but some issues go beyond the individual IETF WGs, or could benefit from additional contributions from a wider audience, reviews and information sharing.
> Examples include:
> - Rekeying with PFS vs. stateless operations [2]
> - Firmware updates using group communication
> - Efficient and secure tunnelling of CoAP in CoAP
> - Notifications surviving rekeying
> - Progressing pub-sub with CoAP
>  
>  
>  
> * Why?
>  
> To progress applications of CoAP in different security settings which "touch standardization in the IETF" [1] but are not necessarily in scope of a single working group like CoRE, ACE, SUIT, COSE, LAKE, etc.
>  
>  
> * How?
>  
> Through a "sister" of WISHI:  A recurring meeting series under the T2TRG umbrella about topics on security for constrained RESTful environments. Working name: seccore (which apparently may mean "dryness" in some Italian context; not intended as a characterization of the content :-)  Frequency and topics open for discussion.
>  
>  
> * Comments?
>  
> What do people think?
>  
> Should we try to have a first meeting before the upcoming holiday season?
>  
>  
> Göran
>  
> [1] Thing-to-Thing (t2trg) - (ietf.org)
> [2] [core] KUDOS, PFS and operations considerations (ietf.org)
>  
>  
>  
> From: core <[e-mail]> on behalf of Christian Amsüss <[e-mail]>
> Date: Tuesday, 16 November 2021 at 15:57
> To: [e-mail] <[e-mail]>
> Subject: Re: [core] CoRE applications side meetings (pubsub / dynlink)?
> 
> Hello,
> 
> On Tue, Nov 09, 2021 at 05:17:39PM +0100, Christian Amsüss wrote:
> > based on the feedback that arrived, a small group will meet tomorrow
> > (Thursday) 10:00 UTC in the hackathon area to look through some
> > applications (pubsub, problem-details), possibly doing examples or check
> > out how things align with current CoRAL.
> 
> the small group was not all that small and very lively -- thanks
> everyone for participating!
> 
> I've attached the minutes here in case the pad we used[1] goes away.
> 
> While we figure out how to best make more of the CoRE ecosystem publicly
> visible at coap.technology, we can already start collecting material at
> the wiki[2].
> 
> Best regards
> Christian
> 
> [1]: https://notes.ietf.org/GaM_PWd2TnmY0DrTe6DdQA?view
> [2]: https://protect2.fireeye.com/v1/url?k=f4bbca08-ab20f04d-f4bb8a93-867b36d1634c-1b783ca428431080&q=1&e=a3621d21-f226-4875-acd7-faaf5c694f88&u=https%3A%2F%2Fgithub.com%2Fcore-wg%2Fwiki%2Fwiki
> 
> -- 
> To use raw power is to make yourself infinitely vulnerable to greater powers.
>   -- Bene Gesserit axiom