Subject: [core] Constrained Application Autoconfiguration

From: 王妍 <[email-masked]>
Date: Tue, 22 May 2012 17:24:22 +0800

Hi  Johanna, Basavaraj, Teemu, Markus, Zach, Carles and Mehmet，

I am very interested in this draft. We encountered a problem related to this
draft in our project. We want to inquire to you guys and hope to get your
help.

Our partner produces household appliances, and these products need
authentication when the customers buy and use them. As mentioned in the
draft, because of the additional costs or other reasons, household
appliances manufacturer would not like to add the module for setting the
pre-shared key or server's public key in their products. We realize
automatic authentication from server to client through remote inquiring
client public key by the server. But how the client could authenticate the
server is still an open unsolved problem, and currently it is ignored since
intelligent household appliances are not widely used, although it should be
solved.

“One option is that the constrained device comes pre-configured with some
DTLS key just for the configuration purpose that the user has to keep
secret.”

I am not quite understand how this method solves the problem of
authentication from client to server. How to guarantee that the client
chooses its own family server, not the neighbors’? And is there any other
solution with lower cost? 

Best regards, 

Yan