From nobody Tue Nov 8 08:29:59 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D6541294A3 for <6tisch-security@ietfa.amsl.com>; Tue, 8 Nov 2016 08:29:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.398 X-Spam-Level: X-Spam-Status: No, score=-3.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5RpRv0X2Iww7 for <6tisch-security@ietfa.amsl.com>; Tue, 8 Nov 2016 08:29:55 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C563B1294D3 for <6tisch-security@ietf.org>; Tue, 8 Nov 2016 08:29:55 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 6286AE203 for <6tisch-security@ietf.org>; Tue, 8 Nov 2016 11:45:42 -0500 (EST) Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id D708A637A8 for <6tisch-security@ietf.org>; Tue, 8 Nov 2016 11:29:54 -0500 (EST) From: Michael Richardson To: tisch-security <6tisch-security@ietf.org> X-Attribution: mcr X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Date: Tue, 08 Nov 2016 11:29:54 -0500 Message-ID: <21948.1478622594@obiwan.sandelman.ca> Archived-At: Subject: [6tisch-security] I missed meeting today X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Nov 2016 16:29:58 -0000 My appologies, I wasn't wakeful enough to realize check my calendar and get the meeting organized. I imagine the webex didn't start without me, and the meeting failed. I'd like to reschedule to after IETF if we can. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ From nobody Sun Nov 13 15:08:54 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33E701296A9; Sun, 13 Nov 2016 15:08:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VVcoQ-4kD2yd; Sun, 13 Nov 2016 15:08:34 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DCDA1296A8; Sun, 13 Nov 2016 15:08:26 -0800 (PST) Received: from dooku.sandelman.ca (unknown [182.172.168.109]) by relay.sandelman.ca (Postfix) with ESMTPS id DC6FD1F906; Sun, 13 Nov 2016 23:08:24 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 8B7DE321D; Sun, 13 Nov 2016 18:08:21 -0500 (EST) From: Michael Richardson To: Brian E Carpenter In-reply-to: <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> Comments: In-reply-to Brian E Carpenter message dated "Thu, 27 Oct 2016 14:00:44 +1300." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <24909.1479078501.1@dooku.sandelman.ca> Date: Mon, 14 Nov 2016 08:08:21 +0900 Message-ID: <24910.1479078501@dooku.sandelman.ca> Archived-At: Cc: anima-bootstrap , 6tisch-security <6tisch-security@ietf.org> Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Nov 2016 23:08:36 -0000 Brian E Carpenter wrote: > My model was that the proxy would get all the floods available and > choose the one it liked best, based on the available method and > distance, using the weight and priority as for mDNS. (Personally I > think the mDNS stuff is overkill, but Toerless suggested we should be > feature-equivalent.) I never proposed that the Proxy would learn of the registrar via mDNS, btw. > 2. Your CDDL looks OK to me. The format and semantics of the value > field of a GRASP objective are completely flexible, so I don't see a > problem with the first "request" to the Registrar being [IID, > join-method]. The reply from the registrar could be [IID, > another-join-method] if it didn't like the first one proposed. Once > either side receives a join-method it likes, it would send > [M_END,,[O_ACCEPT]] and we're done. > 3. Mini-question, is this really IPv6-specific? If not I'd prefer a > name that flags it as an AN infrastructure objective, e.g. "AN_Join" okay. The problem in 6tisch for proxy<->registrar communication (admission control) is the TCP stack required. From nobody Sun Nov 13 16:06:42 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 783471295F5; Sun, 13 Nov 2016 16:06:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qo6PGw3DmjtF; Sun, 13 Nov 2016 16:06:38 -0800 (PST) Received: from mail-pg0-x236.google.com (mail-pg0-x236.google.com [IPv6:2607:f8b0:400e:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 677FC129558; Sun, 13 Nov 2016 16:06:38 -0800 (PST) Received: by mail-pg0-x236.google.com with SMTP id 3so46678870pgd.0; Sun, 13 Nov 2016 16:06:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=ptx6+fXFusiV8cNPB1WxjssHYZDR6swqj5oa/HxTLsU=; b=grwIjpbqusruNDB8Pd8ikgCpWmDF3KoX4o5ejMsC6TELih75QQewXPyX8gugocS6JD 789SQW/WZj0ByAMFGJ18tpPzgYcKMu8iW+qgYzzSwwI8ByRfXlWM51zHVp2sXbVM2J3U EFiI1Kge+6VXHVwVQI9qMWylVdKJKBB4kcV7V5gLaBh9McarqKfLAvVS3qyKgIvc2xzB jfdqhP6PuEeeCYz4c15EvPacXHMj5GKqzF06eTEGjSVQv75byKbcYte1Ka6EMvhjLkkj x28PGhQD+THmOVUx4n8cwYlQ3qaxd1HMv2XkT0cVCxKMI6O4c0mViLpswfpIgt+5vlRm CvQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-transfer-encoding; bh=ptx6+fXFusiV8cNPB1WxjssHYZDR6swqj5oa/HxTLsU=; b=HZW6nV6iwENxkcVJZ/IUX3v5VgGe6ufWvFiMTOFW9tPPptFrK+3jRtI6i/iuVqWkG6 aEA97LzuImEvmYWm7GTP0vg/1+uZ+8LdTWMvM5mpIYAokUCRtRI+D237WOgXymgzuiS8 RHubiHEsNKZqk5mpHJkfSV9xNSgz0648zrjAl+0z5FTACZ654VzysathFuW4PMkE1u2u LvVShmNpBcuud5pkwfoJvtbugQfsZ7o7imROwoE6TbIedQMSuAuT1XfTmjkyHDuPDjQh 8RV8JlVPBLzN3mjXncujpEA/RjEawX9MpnShXocbZPU6Zzq1zsQHolvVqy8o4iDpB5cC RHiQ== X-Gm-Message-State: ABUngvfCak6wUhFGZ00pd65iExu9WsgeXvkWkYjPmX3ZvsbmdSAggnSCERG7TQ6Y3/O34g== X-Received: by 10.99.97.15 with SMTP id v15mr24343637pgb.10.1479081997807; Sun, 13 Nov 2016 16:06:37 -0800 (PST) Received: from [192.168.178.23] (169.221.47.163.dynamic.snap.net.nz. [163.47.221.169]) by smtp.gmail.com with ESMTPSA id c2sm30346955pfl.66.2016.11.13.16.06.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 13 Nov 2016 16:06:37 -0800 (PST) To: Michael Richardson References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> <24910.1479078501@dooku.sandelman.ca> From: Brian E Carpenter Organization: University of Auckland Message-ID: Date: Mon, 14 Nov 2016 13:06:33 +1300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <24910.1479078501@dooku.sandelman.ca> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Archived-At: Cc: anima-bootstrap , 6tisch-security <6tisch-security@ietf.org> Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 00:06:39 -0000 On 14/11/2016 12:08, Michael Richardson wrote: > Brian E Carpenter wrote: > > My model was that the proxy would get all the floods available and > > choose the one it liked best, based on the available method and > > distance, using the weight and priority as for mDNS. (Personally I > > think the mDNS stuff is overkill, but Toerless suggested we should be > > feature-equivalent.) > > I never proposed that the Proxy would learn of the registrar via mDNS, btw. > > > 2. Your CDDL looks OK to me. The format and semantics of the value > > field of a GRASP objective are completely flexible, so I don't see a > > problem with the first "request" to the Registrar being [IID, > > join-method]. The reply from the registrar could be [IID, > > another-join-method] if it didn't like the first one proposed. Once > > either side receives a join-method it likes, it would send > > [M_END,,[O_ACCEPT]] and we're done. > > > 3. Mini-question, is this really IPv6-specific? If not I'd prefer a > > name that flags it as an AN infrastructure objective, e.g. "AN_Join" > > okay. The problem in 6tisch for proxy<->registrar communication (admission > control) is the TCP stack required. Right. I've been assuming that a "BRSKI-COAP" method is available, and if we use GRASP Flood, no TCP is needed at the pledge side. Brian From nobody Sun Nov 13 23:18:09 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14BD3129554; Sun, 13 Nov 2016 23:18:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fwNaCmuEv6jo; Sun, 13 Nov 2016 23:18:08 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7075129420; Sun, 13 Nov 2016 23:18:07 -0800 (PST) Received: from dooku.sandelman.ca (s2001067c037001280a1196fffe0181e0.v6.meeting.ietf.org [IPv6:2001:67c:370:128:a11:96ff:fe01:81e0]) by relay.sandelman.ca (Postfix) with ESMTPS id 3EE371F8EE; Mon, 14 Nov 2016 07:18:06 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id C459F28A4; Mon, 14 Nov 2016 02:18:02 -0500 (EST) From: Michael Richardson to: 6tisch-security <6tisch-security@ietf.org>, anima-bootstrap In-reply-to: References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> <24910.1479078501@dooku.sandelman.ca> Comments: In-reply-to Brian E Carpenter message dated "Mon, 14 Nov 2016 13:06:33 +1300." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Mon, 14 Nov 2016 16:18:02 +0900 Message-ID: <5562.1479107882@dooku.sandelman.ca> Archived-At: Cc: Brian E Carpenter Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 07:18:09 -0000 --=-=-= Content-Type: text/plain Brian E Carpenter wrote: >> > 3. Mini-question, is this really IPv6-specific? If not I'd prefer a >> > name that flags it as an AN infrastructure objective, e.g. "AN_Join" >> >> okay. The problem in 6tisch for proxy<->registrar communication >> (admission control) is the TCP stack required. > Right. I've been assuming that a "BRSKI-COAP" method is available, and > if we use GRASP Flood, no TCP is needed at the pledge side. BRSKI-CoAP lets us do the *ENROLLMENT* over CoAP, not the discovery. These are the interactions, and I will try to give some names to the various interactions in a future document, but suggestions most welcome. 1) pledge <-> Join Assistant (JA) Discovery of JA: mDNS and/or M_FLOOD 2) Join Assistant *discovery* of Registrar in 6tisch, omitted, will be provisioned in ANIMA, uses GRASP M_DISCOVERY 3) Join Assistant tentative admission control (used in 6tisch, to provide {optional?} "move along" feedback.). 6tisch, currently M_REQ_NEG/M_END over *TCP*, need to be fixed. 4) pledge <-> Registrar. in ANIMA, this is pledge---TCP/HTTPS---> Registrar (RFC7030) in 6tisch-zero-touch, this is Registrar ---CoAP/DTLS--> pledge [maybe EDHOC] (CoMI: draft-ietf-netconf-keystore-00 ) in 6tisch-minimal-security, this is pledge-->CoAP/EDHOC--> Registrar -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJYKWUqAAoJEJVM4Vb9/EKQGM8H/1d9jHn83fVGJvbvWSRnnRVZ JdtOT95/oSAV3OCjkRNIPbZbMnVSFrKDy017fJC9luldwzTJYApTA0R2r2/rrsRU Hukz6S7HckvH/2uHcdid2V9z5W8sI/VC34fq4vFvJO4jXMfPwNNoAt0UbFIVJjAO 7iLmqjuqytnS+/ulf3wOQYKtZe642AdmASMNNQoybmBYvTz80zyoQ5sLxJyBJNXB sUmQag+t2sqWRL+xezEImOumL6qNlp1A98vpaDpMxZAzb/48ixxlk2rRPy6wx6Dq EPD0zjWuRXlXzN6UB3KaLy/sy0FiJ7aMIdpV5uSseyFWqH5/K7d50HPK1vVHnJ0= =j5LT -----END PGP SIGNATURE----- --=-=-=-- From nobody Sun Nov 13 23:44:35 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC4541296CE; Sun, 13 Nov 2016 23:44:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G7Jduf5Q5deG; Sun, 13 Nov 2016 23:44:33 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86D501296CD; Sun, 13 Nov 2016 23:44:33 -0800 (PST) Received: from dooku.sandelman.ca (s2001067c037001280a1196fffe0181e0.v6.meeting.ietf.org [IPv6:2001:67c:370:128:a11:96ff:fe01:81e0]) by relay.sandelman.ca (Postfix) with ESMTPS id 0437E1F8EE; Mon, 14 Nov 2016 07:44:31 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 505E31937; Mon, 14 Nov 2016 02:44:25 -0500 (EST) From: Michael Richardson to: 6tisch-security <6tisch-security@ietf.org>, anima-bootstrap In-reply-to: <5562.1479107882@dooku.sandelman.ca> References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> <24910.1479078501@dooku.sandelman.ca> <5562.1479107882@dooku.sandelman.ca> Comments: In-reply-to Michael Richardson message dated "Mon, 14 Nov 2016 16:18:02 +0900." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" Date: Mon, 14 Nov 2016 16:44:25 +0900 Message-ID: <9356.1479109465@dooku.sandelman.ca> Archived-At: Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 07:44:35 -0000 --=-=-= Content-Type: text/plain <#secure method=pgpmime mode=sign> to add to my own message: Michael Richardson wrote: mcr> BRSKI-CoAP lets us do the *ENROLLMENT* over CoAP, not the discovery. mcr> These are the interactions, and I will try to give some names to the various mcr> interactions in a future document, but suggestions most welcome. ... mcr> 4) pledge <-> Registrar. mcr> in ANIMA, this is pledge---TCP/HTTPS---> Registrar (RFC7030) It is here that https://datatracker.ietf.org/doc/draft-pritikin-coap-bootstrap/ applies, letting us actually run EST(RFC7030) over CoAP. Calling it BRSKI over CoAP is perhaps slightly misleading, and yet slightly more correct, because the document isn't a general EST over CoAP, but BRSKI specific. --=-=-= Content-Type: text/plain Content-Disposition: inline Content-Description: Signature -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ --=-=-=-- From nobody Mon Nov 14 11:28:35 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AF31129658; Mon, 14 Nov 2016 11:28:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XxmsU-wtPQV3; Mon, 14 Nov 2016 11:28:30 -0800 (PST) Received: from mail-pg0-x22c.google.com (mail-pg0-x22c.google.com [IPv6:2607:f8b0:400e:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17E1B129610; Mon, 14 Nov 2016 11:28:29 -0800 (PST) Received: by mail-pg0-x22c.google.com with SMTP id p66so57218998pga.2; Mon, 14 Nov 2016 11:28:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:organization:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=sJhtFMQR49d5C+1+hEGHfB+4iO8CRDtTyJ+rdFEhals=; b=sMMW+8Mi1xH0dJOBZskm2b9LBtyC+qjNISYdzacFBmNZOHji9z/pm1bW6JvQda8DAO dsyEHUT6x/KW5b+vSbuTYrV4jC3MfiN9jIWONwj3iriSnxJrhT8+qQx1+IZVoV/bUtG4 Hq7DPWXnrf2lG4rkuGikRrHJHOkCKaiY11toBNHykUFGNIB32JfLsWFJJ+OzZIwyxLXL j/y9hTZuf5wb2TjNRmthXEGb68udOfxWn0FCJsAtTfC6QawQM3Y4LtrPXnzIXQHOHQzn cR2THyb3BRrr7z0uovx8faIYhIk4MWr7HBLUxovke1XAQ893aShQz5nJwqwKYIt3gp6j eSTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-transfer-encoding; bh=sJhtFMQR49d5C+1+hEGHfB+4iO8CRDtTyJ+rdFEhals=; b=lbXDw79zFSy2TJttDBG6UaCamF29+ZwZ4SkBERyohjm7j3AoKAug+00FH0ZbzMHC8u EfR2XWSjVLb+ooYFQbDt8pQuaP/jRp5AYjEZ6xKpSPc04RahNDCe3Y6QOycSP2Jhcypu 8aUvBiMrl7jT0PzzQnftL1Nv1krhK3ks2bt3ThYxD41qU489auZuWu+7g8uKEVBn4Kit 29ZPjwvlUHxeUU0xdyuh2hDiU38AZDpSQNrfjYy/2f9laWoWKDdKQ/XO12hR/U3+Sk2b teqt5BjYHNhJM5AVlbGdY+PGcFupn+vnH4JdvgrpADCUXRwuAy648gSn5a8G3B5XPP4H l7ng== X-Gm-Message-State: ABUngvfuEE0flPUaO9umKfZJ91GwPlizFtx9DyjqyKjsjgL77fom69REv/lTzpSqePRCsg== X-Received: by 10.98.155.146 with SMTP id e18mr34825911pfk.45.1479151708496; Mon, 14 Nov 2016 11:28:28 -0800 (PST) Received: from ?IPv6:2406:e007:4874:1:28cc:dc4c:9703:6781? ([2406:e007:4874:1:28cc:dc4c:9703:6781]) by smtp.gmail.com with ESMTPSA id b80sm24915955pfe.52.2016.11.14.11.28.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 14 Nov 2016 11:28:27 -0800 (PST) To: Michael Richardson , 6tisch-security <6tisch-security@ietf.org>, anima-bootstrap References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> <24910.1479078501@dooku.sandelman.ca> <5562.1479107882@dooku.sandelman.ca> From: Brian E Carpenter Organization: University of Auckland Message-ID: <51679334-5725-7279-cdaf-c3866d5f2bd0@gmail.com> Date: Tue, 15 Nov 2016 08:28:25 +1300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <5562.1479107882@dooku.sandelman.ca> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 19:28:31 -0000 On 14/11/2016 20:18, Michael Richardson wrote: > > Brian E Carpenter wrote: > >> > 3. Mini-question, is this really IPv6-specific? If not I'd prefer a > >> > name that flags it as an AN infrastructure objective, e.g. "AN_Join" > >> > >> okay. The problem in 6tisch for proxy<->registrar communication > >> (admission control) is the TCP stack required. > > > Right. I've been assuming that a "BRSKI-COAP" method is available, and > > if we use GRASP Flood, no TCP is needed at the pledge side. > > BRSKI-CoAP lets us do the *ENROLLMENT* over CoAP, not the discovery. Yes, understood, my point was that since Flood is UDP, the pledge doesn't need to do anything but listen for LL multicasts - no actual discovery is neeeded. That seems like a bonus for pledges. > These are the interactions, and I will try to give some names to the various > interactions in a future document, but suggestions most welcome. > > 1) pledge <-> Join Assistant (JA) > Discovery of JA: mDNS and/or M_FLOOD Is Join Assistant the agreed terminology (instead of Proxy)? > > 2) Join Assistant *discovery* of Registrar > in 6tisch, omitted, will be provisioned > in ANIMA, uses GRASP M_DISCOVERY Is it permissible for the Registrar to act as its own Join Assistant for on-link neighbors? (I can't see why not.) > > 3) Join Assistant tentative admission control (used in 6tisch, to provide > {optional?} "move along" feedback.). > 6tisch, currently M_REQ_NEG/M_END over *TCP*, need to be fixed. > > 4) pledge <-> Registrar. > in ANIMA, this is pledge---TCP/HTTPS---> Registrar (RFC7030) > in 6tisch-zero-touch, this is Registrar ---CoAP/DTLS--> pledge [maybe EDHOC] > (CoMI: draft-ietf-netconf-keystore-00 ) > in 6tisch-minimal-security, this is pledge-->CoAP/EDHOC--> Registrar > Thanks, a useful summary. Brian From nobody Mon Nov 14 17:02:55 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 315021295A0; Mon, 14 Nov 2016 17:02:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fgb6U3D8oiuQ; Mon, 14 Nov 2016 17:02:53 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D631129411; Mon, 14 Nov 2016 17:02:53 -0800 (PST) Received: from dooku.sandelman.ca (dhcp-8d96.meeting.ietf.org [31.133.141.150]) by relay.sandelman.ca (Postfix) with ESMTPS id B0DBC1F91A; Tue, 15 Nov 2016 01:02:51 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 3C3E91928; Mon, 14 Nov 2016 20:02:49 -0500 (EST) From: Michael Richardson To: Brian E Carpenter In-reply-to: <51679334-5725-7279-cdaf-c3866d5f2bd0@gmail.com> References: <20351.1476971471@obiwan.sandelman.ca> <0343d14c-5b18-b821-c9ad-d77fb7dae490@gmail.com> <12808a8a-5de1-c6cb-3f96-945573041ee4@gmail.com> <24910.1479078501@dooku.sandelman.ca> <5562.1479107882@dooku.sandelman.ca> <51679334-5725-7279-cdaf-c3866d5f2bd0@gmail.com> Comments: In-reply-to Brian E Carpenter message dated "Tue, 15 Nov 2016 08:28:25 +1300." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Tue, 15 Nov 2016 10:02:49 +0900 Message-ID: <4807.1479171769@dooku.sandelman.ca> Archived-At: Cc: anima-bootstrap , 6tisch-security <6tisch-security@ietf.org> Subject: Re: [6tisch-security] [Anima-bootstrap] 6tisch join -01 documented posted X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Nov 2016 01:02:54 -0000 --=-=-= Content-Type: text/plain Brian E Carpenter wrote: >> These are the interactions, and I will try to give some names to the various >> interactions in a future document, but suggestions most welcome. >> >> 1) pledge <-> Join Assistant (JA) >> Discovery of JA: mDNS and/or M_FLOOD > Is Join Assistant the agreed terminology (instead of Proxy)? I prefer it, and it's the accepted 6tisch terminology, but I don't think that ANIMA has agreed to use that term, and is using Proxy. >> 2) Join Assistant *discovery* of Registrar >> in 6tisch, omitted, will be provisioned >> in ANIMA, uses GRASP M_DISCOVERY > Is it permissible for the Registrar to act as its own Join Assistant > for on-link neighbors? (I can't see why not.) Yes, these are roles, not machines. >> 3) Join Assistant tentative admission control (used in 6tisch, to provide >> {optional?} "move along" feedback.). >> 6tisch, currently M_REQ_NEG/M_END over *TCP*, need to be fixed. >> >> 4) pledge <-> Registrar. >> in ANIMA, this is pledge---TCP/HTTPS---> Registrar (RFC7030) >> in 6tisch-zero-touch, this is Registrar ---CoAP/DTLS--> pledge [maybe EDHOC] >> (CoMI: draft-ietf-netconf-keystore-00 ) >> in 6tisch-minimal-security, this is pledge-->CoAP/EDHOC--> Registrar >> > Thanks, a useful summary. I'd like to give a name to each exchange. BRSKI is clearly covers #4, but arguably, it covers all four interactions, and #4 is the BRSKI mode of EST. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJYKl65AAoJEJVM4Vb9/EKQiPgH/3iRyGjbB1ZaP0i1xm+C6MXC qTJV4CmOrhPfnC8JTU7y12UhM68y7vYvSGyEHKG+RgF+RfwMwFuMoqbX5u+rkQ4Y aEv5VzZTpO2QrOToe3MEorr3CukXvKrlMh32Ci4tdZTY1lZ4vKvJ59z3bFabOLJC R8IUS3GHFJaoZ7aLYrqQjM1u+9Yavw+fr9mkWv4pB0Ok16q9VS1PIQHr0S76BVk8 zqmxMyLLM5Yv97Ta5U5ByucKABMAGcKVuWmPr7g5LJ+zbGB279JKj5mWG9UV6V8i wCcw66on6xgcVsyT30WAiljhkEefn++brHeNBPDzyWeUWUsUYCeWN7LI4O/r1Q0= =hzI3 -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Nov 17 19:30:58 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45E281293D8; Thu, 17 Nov 2016 19:30:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xfW2vvgo-wzE; Thu, 17 Nov 2016 19:30:54 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50CE71293D6; Thu, 17 Nov 2016 19:30:54 -0800 (PST) Received: from dooku.sandelman.ca (dhcp-8d96.meeting.ietf.org [31.133.141.150]) by relay.sandelman.ca (Postfix) with ESMTPS id C7D2B1F418; Fri, 18 Nov 2016 03:30:52 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 6693B33DD; Fri, 18 Nov 2016 12:30:49 +0900 (KST) From: Michael Richardson To: 6tisch-security@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Fri, 18 Nov 2016 12:30:49 +0900 Message-ID: <8226.1479439849@dooku.sandelman.ca> Archived-At: Cc: 6tisch@ietf.org, anima@ietf.org Subject: [6tisch-security] 6tisch security bi-weekly meetings X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: 6tisch@ietf.org List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 03:30:56 -0000 --=-=-= Content-Type: text/plain The 6tisch security design team will meet every two weeks starting on November 29th at 14:00 UTC. The meeting is anchored to UTC, not EST, but that will matter only in March. The nov. 29th meeting will be devoted to: a) recap of IETF97; work ensuing from the meeting. b) 6tisch-minimal-security Tuesday, November 29, 2016 9:00 am Eastern Standard Time (GMT-05:00) Recurrence: Every 2 weeks on Tuesday, from Tuesday, November 29, 2016, to Tuesday, March 21, 2017 Meeting number: 641 335 839 Meeting password: pledge Meeting link: https://ietf.webex.com/ietf/j.php?MTID=me98f12cebda5e6b55c1b8c66c095d0a9 Host key: 587716 Audio connection: 1-877-668-4493 Call-in toll free number (US/Canada) 1-650-479-3208 Call-in toll number (US/Canada) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJYLnXpAAoJEJVM4Vb9/EKQJSoIAIzq0506mP9lJbxqzXNi1lTQ JhOZF6VAhPpEUKQvHqrnOZRYoGb2GSrMhTLbZ4hgZZ4b/El0G1sdg0+ZW2uzppbU 2/lMrUvQDDROamCHkcmv2jtOMslseieKpmTUz4xDdGXuuHK1isbDvZbRU3+Padc2 uze9qyuWsVY1Ek+I6NPijPCRyADfCz6Z8RpPT6AHaoD0Uk7L/ES6mWEZ+e23wazN lOlzTck50XqgYQ++0qNQVOhJ1eut/GfDNJcdmf7Xz1IsctRVEO6SUAHlAvSP88HB KSHYnp2nZeAEl04exSKrsZB7wuGqfbLy5nJxhoGQEgtM02jo1g6ryZ+0Phufnq8= =Imkr -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Nov 28 11:29:17 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32CC5129F8B for <6tisch-security@ietfa.amsl.com>; Mon, 28 Nov 2016 11:29:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.398 X-Spam-Level: X-Spam-Status: No, score=-3.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kS7hL4qwON5W for <6tisch-security@ietfa.amsl.com>; Mon, 28 Nov 2016 11:29:13 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7BCB1296B7 for <6tisch-security@ietf.org>; Mon, 28 Nov 2016 11:29:12 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 5995F200A3 for <6tisch-security@ietf.org>; Mon, 28 Nov 2016 14:46:08 -0500 (EST) Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A9DD3637A6 for <6tisch-security@ietf.org>; Mon, 28 Nov 2016 14:29:11 -0500 (EST) From: Michael Richardson To: 6tisch-security@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [6tisch-security] reminder --- 6tisch security meeting tomorrow X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Nov 2016 19:29:15 -0000 --=-=-= Content-Type: text/plain details are: https://www.ietf.org/mail-archive/web/6tisch-security/current/msg00629.html -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEVAwUBWDyFhICLcPvd0N1lAQL0uQf/XsvlmkJpfZgPIG6d46LqSszTo/My/ooi yx9Ve19Gmsl0QyOBB4NwLqY8f556cdv/uaKLPPOpmLFN3e/de3HL4ZloNRk91NrQ PnfMlhF5qALcD3UfS/raNgbEqcGp1BurWLKDgZk9+T6kyQni2Zb99pWVUDPmvaEy zLQzYgNt5oifPGvtDPZLuE7vZFVY/OYl8AvzIRR8237/L1Cqg6eu2LmPQGzC5b2I LgB5Ac2AhFMsNM/Pbxob9Qaeocs/FwCSXUjJ5oCKk++F3ktC259IXnQXJQnBUNjs GcLWyal2XcVadgU25Xi9geC2REn+Iy8f9z5TVca2joczHMVzZ16pjA== =Uucb -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Nov 30 01:28:29 2016 Return-Path: X-Original-To: 6tisch-security@ietfa.amsl.com Delivered-To: 6tisch-security@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F076129E15 for <6tisch-security@ietfa.amsl.com>; Wed, 30 Nov 2016 01:28:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.397 X-Spam-Level: X-Spam-Status: No, score=-8.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.497] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H59ED24D1mut for <6tisch-security@ietfa.amsl.com>; Wed, 30 Nov 2016 01:28:25 -0800 (PST) Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C26F129E22 for <6tisch-security@ietf.org>; Wed, 30 Nov 2016 01:25:00 -0800 (PST) X-IronPort-AV: E=Sophos;i="5.31,573,1473112800"; d="scan'208";a="202280982" Received: from unknown (HELO [128.93.84.195]) ([128.93.84.195]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-SHA; 30 Nov 2016 10:24:58 +0100 From: =?utf-8?Q?Mali=C5=A1a_Vu=C4=8Dini=C4=87?= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: Date: Wed, 30 Nov 2016 10:24:59 +0100 To: tisch-security <6tisch-security@ietf.org> Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [6tisch-security] Who initiates Phase 2? X-BeenThere: 6tisch-security@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 09:28:27 -0000 Michael, Coming back to the discussion on who initiates the exchange in Phase 2 = of the join protocol. My understanding of the IETF 97 meeting outcome is that Phase 1 and = Phase 2 will be ran in sequence. Phase 1 runs to completion with = manufacturer-installed certificate as the start state and = locally-relevant credential as the end state. Phase 2 immediately takes = over and uses the locally-relevant credential as the start state and = network-wide K2 as the end state.=20 In that setup, I don=E2=80=99t really see why it matters who initiates = Phase 2. Being it JCE, we end up having a PUT and a response (two = messages). Being it JN, we end up with a GET and a response (two = messages). Either way, messages are exchanged in a sequence initiated by = the party that initiated Phase 1. Matching CoAP=E2=80=99s client/server = role to the role in the key agreement protocol is not necessary, I = believe. Am I missing something? Mali=C5=A1a