Subject: [core] WGLC draft-ietf-core-coap-13 Certificate Authority Name

From: "Keoh, Sye Loong" <[email-masked]>
Date: Fri, 11 Jan 2013 08:22:57 +0000

Dear Carsten, Klaus, Zach and all,

We would like to confirm our understanding with regards to the use of Certificates in DTLS in core-coap.
In Section 9.1.3.3. (http://tools.ietf.org/html/draft-ietf-core-coap-13#section-9.1.3), it defines the following:

The Authority Name in the certificate is the name that would be used in the Host part of a CoAP URI.  It is worth noting that this would typically not be either an IP address or DNS name built in the usual way but would instead be built out of a long term unique identifier for the device such as the EUI-64 [EUI64<http://tools.ietf.org/html/draft-ietf-core-coap-13#ref-EUI64>].  The discovery process used in the system would build up the mapping between IP addresses of the given devices and the Authority Name for each device. Some    devices could have more than one Authority and would need more than a single certificate.

Our understanding is that :
1.       The Authority Name in the Certificate is preferably not an IP address, nor a DNS name.
2.       The Authority Name should preferably be the device’s EUI-64. (or another such identifier if available)
3.       There is a known mapping between IP addresses of a given device and its EUI (i.e. the Authority Name in the certificate).
4.       A (discovery) process is used such that a CoAP endpoint can learn about, and internally store, relevant mapping entries. (Prior to the step below)
5.       When exchanging certificates during the DTLS handshake, the Authority Name (EUI-64) in the certificate is mapped to the device’s IP address based on the mapping. Then this IP address is checked against the IP address of the communication partner. Thus, ensuring that the handshake request originates from the correct CoAP device.
6.       The mapping between IP addresses and EUI is not defined in CoAP and it is left to implementers.

Is our understanding above conforming to the intent of the draft?

best regards,
Sye Loong Keoh
Esko Dijk

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.