Subject: Re: [core] Fw: New Version Notification for draft-bhattacharyya-core-coap-lite-auth-00

From: Abhijan Bhattacharyya <[email-masked]>
Date: Wed, 2 Apr 2014 12:52:13 +0530

Hi Akbar,
First of all, thank you very much for sparing some time for the draft.
Answers in line:

 If you carry the Authentication payload in the POST (e.g. Figure 2) does 
that mean it is carried in clear text?  Or do  you actually already have a 
DTLS session underneath CoAP?  The sequence of events is not clear to me.

Other than the initial HELLO payload in rest of the exchanges are 
encrypted. That is why the payload is represented within 'AES(....)'.
There is no DTLS session assumed. Actually the authentication and key 
establishment mechanism is thought of as an alternative to what happens 
with DTLS-PSK. May be we can integrate this scheme with DTLS in future. We 
are actually working with several possible options using this scheme that 
can either provide a light weight scheme to establish an authenticated and 
secured scheme specific to CoAP or may lead to some dimension that might 
modify DTLS itself to create a lightweight alternative within the DTLS 
framework.

Did you consider taking your draft to DICE ( 
http://datatracker.ietf.org/wg/dice/charter/ ) where it seems to fit the 
charter much better than CORE?

We had a bit of dilemma regarding which mailing list should we submit this 
draft to - CoRE or Dice. But we decided to stick to CoRE for the time 
being as the draft at present proposes a generic solution with 
implementation details specific to CoAP which should be best understood by 
people in CoRE. Dice is mostly dealing with optimization of DTLS. However, 
we may transfer to Dice if , as mentioned earlier, we manage to bring in 
some modification into DTLS based on the proposed scheme. 
As a second thought, should this one be a better candidate for ACE? 
Although ACE is presently zeroing in on some specific architecture while 
it is going through the formative stage of preparing the charter, but may 
be open to options, as discussed during the meetings, for some special 
alternatives in future.

Editorial: What was the ?WIP? in the title referring to?

WIP stands for Work In Progress. We thought, it would be a standard way of 
representation. Apologies for the confusion. Could have easily expanded 
it.

Any further comments/ concerns will be highly appreciated.

Regards
Abhijan Bhattacharyya
Associate Consultant
Scientist, Innovation Lab, Kolkata, India
Tata Consultancy Services Limited
Mailto: [email-masked]
Website: http://www.tcs.com
____________________________________________
Experience certainty.   IT Services
                        Business Solutions
                        Consulting
____________________________________________

From:
"Rahman, Akbar" <[email-masked]>
To:
"Abhijan Bhattacharyya" <[email-masked]>
Cc:
<[email-masked]>
Date:
03/28/2014 03:48 AM
Subject:
RE: [core] Fw: New Version Notification for 
draft-bhattacharyya-core-coap-lite-auth-00

Hi Abhijan,

I had a chance to read your interesting draft, and had some initial 
questions:

·         If you carry the Authentication payload in the POST (e.g. Figure 
2) does that mean it is carried in clear text?  Or do  you actually 
already have a DTLS session underneath CoAP?  The sequence of events is 
not clear to me.
 
·         Did you consider taking your draft to DICE ( 
http://datatracker.ietf.org/wg/dice/charter/ ) where it seems to fit the 
charter much better than CORE?
·         Editorial: What was the ?WIP? in the title referring to?

Thanks,

Akbar

From: core [mailto:[email-masked]] On Behalf Of Abhijan 
Bhattacharyya
Sent: Monday, March 03, 2014 9:04 AM
To: [email-masked] WG
Subject: [core] Fw: New Version Notification for 
draft-bhattacharyya-core-coap-lite-auth-00
 
Dear All,
We have uploaded a proposal on a lightweight application-layer mutual 
authentication scheme for CoAP. Since this was specific to CoAP we have 
uploaded in CoRE. Not sure if ACE would have been a suitable place. But, 
ACE is yet come up with a concrete problem definition. So, keeping it in 
CoRE so that at least the proposal could be publicly accessed if 
considered as a potential solution to some requirements.
 
The draft is part of a larger work in progress with some promising 
results. 
 
Comments, suggestions are welcome.

Regards
Abhijan Bhattacharyya
Associate Consultant
Scientist, Innovation Lab, Kolkata, India
Tata Consultancy Services Limited
Mailto: [email-masked]
Website: http://www.tcs.com
____________________________________________
Experience certainty. IT Services
Business Solutions
Consulting
____________________________________________

-----Forwarded by Abhijan Bhattacharyya/KOL/TCS on 03/03/2014 07:23PM 
-----
To: Soma Bandyopadhyay <[email-masked]>, "Soma Bandyopadhyay" 
<[email-masked]>, "Abhijan Bhattacharyya" <
[email-masked]>, "Arijit Ukil" <[email-masked]>, 
Arijit Ukil <[email-masked]>, Arpan Pal <[email-masked]>, "Arpan 
Pal" <[email-masked]>, "Tulika Bose" <[email-masked]>, Abhijan 
Bhattacharyya <[email-masked]>, Tulika Bose <
[email-masked]>
From: [email-masked]
Date: 03/03/2014 07:07PM
Subject: New Version Notification for 
draft-bhattacharyya-core-coap-lite-auth-00.txt
A new version of I-D, draft-bhattacharyya-core-coap-lite-auth-00.txt
has been successfully submitted by Abhijan Bhattacharyya and posted to the
IETF repository.

Name: draft-bhattacharyya-core-coap-lite-auth
Revision: 00
Title: Lightweight mutual authentication for CoAP (WIP)
Document date: 2014-03-03
Group: Individual Submission
Pages: 11
URL:            
http://www.ietf.org/internet-drafts/draft-bhattacharyya-core-coap-lite-auth-00.txt

Status:         
https://datatracker.ietf.org/doc/draft-bhattacharyya-core-coap-lite-auth/
Htmlized:       
http://tools.ietf.org/html/draft-bhattacharyya-core-coap-lite-auth-00

Abstract:
   This draft presents a work-in-progress on a challenge-response based
   lightweight authentication scheme to mutually authenticate CoAP
   client and server for establishing a secure unicast communication
   channel. The draft discusses the generic idea behind the proposed
   authentication scheme, as well as presents its CoAP specific
   adoption. The proposed scheme has low communication overhead and can
   be a robust alternative against the usual DTLS based connection
   initiation scheme with PSK.

Please note that it may take a couple of minutes from the time of 
submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat
=====-----=====-----=====
Notice: The information contained in this e-mail
message and/or attachments to it may contain 
confidential or privileged information. If you are 
not the intended recipient, any dissemination, use, 
review, distribution, printing or copying of the 
information contained in this e-mail message 
and/or attachments to it are strictly prohibited. If 
you have received this communication in error, 
please notify us by reply e-mail or telephone and 
immediately and permanently delete the message 
and any attachments. Thank you