Re: [TLS] bootstrapping of constrained devices

[Robert Cragie <[e-mail]>]

Hi Rene,

There is certainly a place for device certificates but they are 
generally quite expensive in terms of the infrastructure needed to 
support them as Michael points out.

There are no specific links I can point to but the use case is using 
relatively short codes which are put into e.g. a home router through a 
web interface to provide steering, a basis for authenticating another 
device onto the network and a secure channel for delivery of 
configuration/bootstrapping information. WPS PIN is an example of this 
(notwithstanding its implementational flaws). Using TLS/DTLS as a basis 
provides the possibility of reuse at the application layer, which is a 
bonus for the relatively constrained devices generally considered to be 
in use in the IoT.

Robert

On 21/03/2014 12:26 PM, Michael Sweet wrote:
> Rene,
>
> Installing device certificates during manufacturing is not a simple 
> process - the factory would need to act as a CA or would need to have 
> a supply of certificates that matches whatever identifiers are used by 
> the devices.  Not to mention how you'd manage revocation if the root 
> was compromised...
>
>
> On Mar 20, 2014, at 9:52 PM, Rene Struik <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>> Hi Robert:
>>
>> Wouldn't it be much easier to embed device certificates with 
>> constrained devices at manufacturing? This may do away with need to 
>> store info that is not public on servers.
>>
>> If you could provide some links to discussions in "IoT community 
>> groups" interested in this, that would help.
>>
>> Best regards, Rene
>>
>> ==
>> There is a lot of interest in the IoT community in using some form of 
>> PAKE in conjunction with DTLS (or TLS with EAP) for authenticating 
>> commissioning/bootstrapping of IoT devices onto IoT networks
>>
>> On 3/20/2014 1:21 PM, Robert Cragie wrote:
>>>
>>> It should be remembered that TLS is used in places other than web 
>>> browsers - the existence of the DICE WG is testament to this. There 
>>> is a lot of interest in the IoT community in using some form of PAKE 
>>> in conjunction with DTLS (or TLS with EAP) for authenticating 
>>> commissioning/bootstrapping of IoT devices onto IoT networks. I 
>>> realise this is different to the original proposition in this thread 
>>> but wanted to draw this to the attention of the WG nevertheless.
>>>
>>> Robert
>>>
>>> On 20 Mar 2014 12:28, "Daniel Kahn Gillmor" <[e-mail] 
>>> <mailto:[e-mail]>> wrote:
>>>
>>>     On 03/20/2014 12:18 PM, Paul Hoffman wrote:
>>>     > As an important note, you did not define "we" above. A few
>>>     possible expansions would be:
>>>     >
>>>     > - The TLS WG, where this thread currently lives, does not get
>>>     to define Web UI without a charter change.
>>>     >
>>>     > - The HTTPbis WG has not asked the TLS WG to take over this
>>>     work, nor has it embraced anything like it.
>>>     >
>>>     > - The IETF doesn't do this kind of work as a whole body.
>>>     >
>>>     > - The IAB (of which none of us are part of the "we") might
>>>     take the topic on and suggest ways which the IETF might do the work.
>>>
>>>     yep, thanks for the clarification.  I actually meant "we" in the
>>>     broad
>>>     sense of "the community of people who care about making
>>>     communications
>>>     on the web more secure", which includes groups you didn't even
>>>     mention
>>>     above, like web site designers, systems administrators, etc.
>>>
>>>     It's still on-topic here (despite the broad scope implied above)
>>>     because
>>>     the TLS WG does have a role to play, by considering the merits of
>>>     proposals like http://tools.ietf.org/html/draft-thomson-tls-care, as
>>>     well as considering alternatives that deal with this particular
>>>     use case.
>>>
>>>     >> option (A) is seriously hard, maybe impossible given the
>>>     state of the
>>>     >> web.  option (B) is terrible.
>>>     >
>>>     > Exactly right, for any value of "we".
>>>
>>>     :(
>>>
>>>             --dkg
>>>
>>>
>>>     _______________________________________________
>>>     TLS mailing list
>>>     [e-mail] <mailto:[e-mail]>
>>>     https://www.ietf.org/mailman/listinfo/tls
>>>
>>>
>>>
>>> _______________________________________________
>>> TLS mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/tls
>>
>>
>> -- 
>> email:[e-mail]  | Skype: rstruik
>> cell: [phone] | US: [phone]
>> _______________________________________________
>> TLS mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/tls
>
> _________________________________________________________
> Michael Sweet, Senior Printing System Engineer, PWG Chair
>