Re: [T2TRG] RESTful Design & Security

[Hannes Tschofenig <[e-mail]>]

Thanks for the pointer to the document, Robby. I wasn't aware of this
spec and I have to gain a better understanding of why JOSE/COSE isn't
applicable but it is certainly a worthwhile path to explore.

Ciao
Hannes


On 03/07/2017 08:47 PM, Simpson, Robby (GE Energy Connections) wrote:
> Personally, I’m a big fan of end-to-end and think that is the correct
> approach.
> 
>  
> 
> However, pragmatically, I realize this is not always possible.
> 
>  
> 
> I haven’t followed it for a while, but there was some activity in
> httpbis at one point for resource/object-level security
> (https://tools.ietf.org/wg/httpbis/draft-ietf-httpbis-encryption-encoding/). 
> If we limit the discussion to protocols that support content codings
> (e.g., HTTP and CoAP), then I would think defining a coding that
> specifies the resource-level security aspects would achieve quite a lot
> and would be able to preserve aspects through protocol conversion.
> 
>  
> 
> - Robby
> 
>  
> 
>  
> 
> Robby Simpson, PhD
> 
> System Architect
> 
> GE
> 
> Grid Solutions
> 
> M: [phone]
> 
> [e-mail]
> 
>  
> 
>  
> 
> *From: *T2TRG <[e-mail]> on behalf of "Kovatsch, Matthias"
> <[e-mail]>
> *Date: *Tuesday, March 7, 2017 at 2:36 PM
> *To: *"[e-mail]" <[e-mail]>,
> "[e-mail]" <[e-mail]>
> *Cc: *"[e-mail]" <[e-mail]>
> *Subject: *EXT: Re: [T2TRG] RESTful Design & Security
> 
>  
> 
> Fair enough.
> 
> Yes, I am on this IoT Directorate. I would say a large fraction of the
> T2TRG participants has been arguing that the Internet of Gateways is not
> a good approach. Your security-related summary proves this point.
> 
> I personally don't see end-to-end security happening if we keep mixing
> application protocols, keep using black-magic middleboxes, and keep
> using proprietary interfaces at the device level. We need something
> end-to-end (or T2T) for end-to-end security.
> 
> Best wishes
> Matthias
> 
> 
> 
> Sent from my phone, limitations might apply.
> 
> -----Original Message-----
> *From:* Hannes Tschofenig [[e-mail]]
> *Received:* Tuesday, 07 Mar 2017, 20:10
> *To:* Kovatsch, Matthias (CT RDA NEC EMB-DE)
> [[e-mail]]; [e-mail]
> [[e-mail]]
> *CC:* [e-mail] [[e-mail]]
> *Subject:* Re: [T2TRG] RESTful Design & Security
> 
> Hi Matthias,
> 
> I know that this is a research group and everyone can create whatever
> they want.
> 
> We briefly talked about security at the IoT directorate conference call
> and I would be interesting to hear what works and what does not work for
> others.
> 
> Ciao
> Hannes
> 
> 
> On 03/07/2017 07:45 PM, Kovatsch, Matthias wrote:
>> On big propaganda tour? :P
>> 
>> Regards
>> Matthias
>> 
>> 
>> Sent from my phone, limitations might apply.
>> 
>> -----Original Message-----
>> *From:* Hannes Tschofenig [[e-mail]]
>> *Received:* Tuesday, 07 Mar 2017, 19:39
>> *To:* Michael Richardson [[e-mail]]
>> *CC:* [e-mail] [[e-mail]]
>> *Subject:* Re: [T2TRG] RESTful Design & Security
>> 
>> OSCOAP does not work when
>> 
>> * you mix protocols,
>> * use a middlebox for some processing interactions (such as data
>> aggregation), and
>> * when one of the protocols is a non-RESTful protocol, such as BLE or MQTT.
>> 
>> Unfortunately, these the use cases we are facing in current IoT
>> deployments. For similar reasons we cannot use RFC 8075 either.
>> 
>> Maybe you are seeing different deployment environments.
>> 
>> Ciao
>> Hannes
>> 
>> On 03/07/2017 06:39 PM, Michael Richardson wrote:
>>> 
>>> Hannes Tschofenig <[e-mail]> wrote:
>>>     > Needless to say that these challenges have also been observed in other
>>>     > protocols as well, such as HTTP and even SIP.
>>> 
>>>     > What is the story for providing application layer security?
>>> 
>>> OSCOAP seems to be end-to-end to me.
>>> 
>>> --
>>> Michael Richardson <[e-mail]>, Sandelman Software Works
>>>  -= IPv6 IoT consulting =-
>>> 
>>> 
>>> 
>> 
>> 
>> 
>> _______________________________________________
>> T2TRG mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/t2trg
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_t2trg&d=DwMF-g&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=4w13vdCVEUj_vaCSQNdKRf25O0P4iaVn04ElXLrB_ak&m=k7IqC4lOSBeG5yZT3lwAYgfq7isPTJ1x7lhosU4sI0U&s=6FyGiDTW-U31FpvuMwpkVdhppH4XLcvlAPPiMqvTUIo&e=>
>> 
>