From nobody Fri Jul 2 15:06:45 2021 Return-Path: X-Original-To: iotops@ietf.org Delivered-To: iotops@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F4F63A0AFD; Fri, 2 Jul 2021 15:03:00 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: iotops@ietf.org, warren@kumari.net X-Test-IDTracker: no X-IETF-IDTracker: 7.34.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <162526338057.26814.8562977692862097171@ietfa.amsl.com> Date: Fri, 02 Jul 2021 15:03:00 -0700 Archived-At: Subject: [Iotops] iotops - Requested session has been scheduled for IETF 111 X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Jul 2021 22:03:12 -0000 Dear Alexey Melnikov, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. iotops Session 1 (1:00 requested) Monday, 26 July 2021, Session III 1600-1800 Room Name: Room 5 size: 505 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/111/sessions/iotops.ics Request Information: --------------------------------------------------------- Working Group Name: IOT Operations Area Name: Operations and Management Area Session Requester: Alexey Melnikov Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 100 Conflicts to Avoid: People who must be present: Alexey Melnikov Henk Birkholz Warren "Ace" Kumari Resources Requested: Special Requests: --------------------------------------------------------- From nobody Fri Jul 2 15:28:15 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8836F3A137E; Fri, 2 Jul 2021 15:27:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SmD-aRvvKy5g; Fri, 2 Jul 2021 15:27:57 -0700 (PDT) Received: from gabriel-2.zfn.uni-bremen.de (gabriel-2.zfn.uni-bremen.de [134.102.50.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 204B63A1379; Fri, 2 Jul 2021 15:27:03 -0700 (PDT) Received: from [192.168.217.118] (p548dcc89.dip0.t-ipconnect.de [84.141.204.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4GGqSh6h98z2xGy; Sat, 3 Jul 2021 00:27:00 +0200 (CEST) From: Carsten Bormann Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Mao-Original-Outgoing-Id: 646957621.451682-f9c0024e82a0bf556785196e06bcef0e Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) Message-Id: <2FFF855D-258F-448D-A99E-29905E645BA9@tzi.org> Date: Sat, 3 Jul 2021 00:27:01 +0200 To: asdf@ietf.org, coin@irtf.org, iotops@ietf.org, danish@ietf.org X-Mailer: Apple Mail (2.3608.120.23.2.7) Archived-At: Subject: [Iotops] Constrained Node/Network Cluster @ IETF111: "FINAL" AGENDA X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Jul 2021 22:28:06 -0000 Here is my usual eclectic condensed agenda based on the "FINAL" AGENDA for IETF111. Remember that further agenda changes can still happen. A number of changes have been made with respect to the draft agenda. Most notably, IOTOPS has moved on top of SECDISPATCH (was on top of RATS), but LAKE stays on RATS. All times *on my agenda* are in UTC (the default page is UTC-0700). Please forgive the 2430 and 2500, I'm way too lazy to write code to turn this into 0030 and 0100. (And it is advisable to ignore the fictional end time of the Wednesday plenary anyway.) https://datatracker.ietf.org/meeting/agenda-utc might be handy. Gr=C3=BC=C3=9Fe, Carsten MONDAY, July 19, 2021 1900-2100 Hackathon Kickoff Rm 1 GEN hackathon Hackathon FRIDAY, July 23, 2021 1900-2100 Hackathon Closing Rm 1 GEN hackathon Hackathon MONDAY, July 26, 2021 1900-2100 Session I Rm 1 ART dispatch Dispatch WG - Joint with ARTAREA Rm 2 IRTF anrw ACM/IRTF Applied Networking Research = Workshop - New Internet Protocols & Practical Congestion Control Rm 3 IRTF pearg Privacy Enhancements and Assessments = Research Group Rm 7 SEC gnap Grant Negotiation and Authorization = Protocol WG 2130-2230 Session II Rm 1 ART wpack Web Packaging WG Rm 2 IRTF irtfopen IRTF Open Meeting Rm 3 OPS anima Autonomic Networking Integrated Model = and Approach WG Rm 4 RTG babel Babel routing protocol WG Rm 8 SEC *** rats Remote ATtestation ProcedureS WG Rm 9 TSV tsvwg Transport Area Working Group WG 2300-2500 Session III Rm 2 ART jsonpath JSON Path WG Rm 3 IRTF coinrg Computing in the Network Research Group Rm 5 OPS *** iotops IOT Operations WG Rm 8 SEC secdispatch Security Dispatch WG Rm 9 TSV masque Multiplexed Application Substrate over = QUIC Encryption WG TUESDAY, July 27, 2021 1900-2100 Session I Rm 1 ART sedate Serialising Extended Data About Times = and Events WG Rm 2 INT 6man IPv6 Maintenance WG Rm 3 IRTF anrw ACM/IRTF Applied Networking Research = Workshop - Interconnection and Routing & Monitoring Internet Traffic Rm 5 RTG bier Bit Indexed Explicit Replication WG Rm 6 RTG raw Reliable and Available Wireless WG Rm 7 SEC *** danish DANE AutheNtication for Iot Service = Hardening BOF Rm 8 TSV quic QUIC WG 2130-2230 Session II Rm 3 ART httpapi Building Blocks for HTTP APIs WG Rm 4 INT dnssd Extensions for Scalable DNS Service = Discovery WG Rm 7 SEC saag Security Area Open Meeting Rm 8 TSV taps Transport Services WG 2300-2500 Session III Rm 7 SEC ohttp Oblivious HTTP BOF WEDNESDAY, July 28, 2021 1900-2100 Session I Rm 1 ART *** core Constrained RESTful Environments WG Rm 3 INT madinas MAC Address Device Identification for = Network and Application Services BOF Rm 4 IRTF anrw ACM/IRTF Applied Networking Research = Workshop - Privacy & Applications Rm 7 SEC tls Transport Layer Security WG 2130-2230 Session II Rm 2 ART uta Using TLS in Applications WG Rm 4 INT *** 6lo IPv6 over Networks of = Resource-constrained Nodes WG Rm 5 INT *** drip Drone Remote ID Protocol WG Rm 8 RTG rift Routing In Fat Trees WG Rm 9 SEC *** cose CBOR Object Signing and Encryption WG 2300-2440 IETF Plenary - Plenary THURSDAY, July 29, 2021 1900-2000 Session I Rm 3 OPS anima Autonomic Networking Integrated Model = and Approach WG Rm 4 OPS v6ops IPv6 Operations WG Rm 7 SEC *** lake Lightweight Authenticated Key Exchange = WG Rm 8 SEC *** rats Remote ATtestation ProcedureS WG Rm 9 TSV tsvwg Transport Area Working Group WG 2030-2130 Session II Rm 5 IRTF qirg Quantum Internet Research Group Rm 6 RTG rtgarea Routing Area Open Meeting Rm 7 SEC mls Messaging Layer Security WG Rm 8 SEC *** rats Remote ATtestation ProcedureS WG 2200-2300 Session III Rm 5 SEC *** ace Authentication and Authorization for = Constrained Environments WG 2330-2430 Session IV Rm 4 IRTF panrg Path Aware Networking RG Rm 8 SEC emu EAP Method Update WG Rm 9 SEC *** teep Trusted Execution Environment = Provisioning WG FRIDAY, July 30, 2021 1900-2100 Session I Rm 1 ART webtrans WebTransport WG Rm 2 INT add Adaptive DNS Discovery WG Rm 5 RTG apn Application-aware Networking BOF Rm 6 SEC *** suit Software Updates for Internet of Things = WG 2130-2230 Session II Rm 1 ART *** cbor Concise Binary Object Representation = Maintenance and Extensions WG Rm 2 IRTF maprg Measurement and Analysis for Protocols Rm 5 RTG detnet Deterministic Networking WG Rm 6 SEC acme Automated Certificate Management = Environment WG Rm 7 SEC privacypass Privacy Pass WG 2300-2500 Session III Rm 1 INT intarea Internet Area Working Group WG Rm 2 IRTF cfrg Crypto Forum Rm 3 IRTF*** dinrg Decentralized Internet Infrastructure Rm 7 SEC *** teep Trusted Execution Environment = Provisioning WG Rm 8 TSV (!) tsvarea Transport Area Open Meeting From nobody Mon Jul 5 23:38:01 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70CAE3A1613 for ; Mon, 5 Jul 2021 23:37:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ohv1RJrIjO2E for ; Mon, 5 Jul 2021 23:37:54 -0700 (PDT) Received: from mail-pl1-x630.google.com (mail-pl1-x630.google.com [IPv6:2607:f8b0:4864:20::630]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FF853A1611 for ; Mon, 5 Jul 2021 23:37:54 -0700 (PDT) Received: by mail-pl1-x630.google.com with SMTP id a6so519694plh.11 for ; Mon, 05 Jul 2021 23:37:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references:reply-to :user-agent:mime-version:content-transfer-encoding; bh=WkTeM/lwiNqO6CEOheJzCoUfC71KKjf64fnxxN0DFww=; b=hTOBhAe+BSMCMLfKpsSCc+hZxyJ2uJ2wRd/N1ZOEjOVSZxCQ2zeD8Tu/R8/TEOfIJZ +6+QZsalNLt/LsyT2osQGSW//3Ly55eoGBHpGv9trcFV9/Hf33c662oWaKrJ/hKXsbKP Bbn87kfGJV6/QsUVsmG/SuQSvtJh8T3qbHZE03u6U0sOvanpQT09cVUhRie5G2mvOacs FaojiHJsqLs8rX4DcfPAVURoznFKams1yiLEOsYjZqT+9JQff0VysYyoaSXN9f2iu3eC 2O/O5tH/oD7ddxFbLp1Ax+rUQKRQHAfiRKQd3WyjF+SYmSVmo+/ycdIAo+LsskNVmByR +Ahg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:reply-to:user-agent:mime-version :content-transfer-encoding; bh=WkTeM/lwiNqO6CEOheJzCoUfC71KKjf64fnxxN0DFww=; b=p6j8h/ryOjBvjjCyLhwvFu5hH9/NlZxlpZ3xbB5r1bcVeYvNP3jiVPhIu7UQeTm3as P0qEOwg5DbUIIfM65IgulF8ilODa4i14VOoDHZoKsxO34fxA5NuuaULw+k+ACdr+3fZf WSe8TRI4BvqgCZg0KakFAvXWb4QpiHO+nUYWhtAGy8EHiZ3cFkEppKh6c5QQ7qBIj0qF 6fRZB3tXK6C1717Eu5qSLF/zJ9EFkk6CFjuPGble8nQHbI4bB/57m+qpMC7eqH+E/Xld 3DHwwj05KsyGdfTdK/UefM7ZSjvbyjlTIbZ94dqLMvxAlmLGCMTyRgMAV69uBjaYe0hI JGVg== X-Gm-Message-State: AOAM533X0TkH89U/wTrAKm24CayGcMUHISpUC0W4FRZtzdhUegmO5l0t 6EueKaLagNI/a/sAbqYCUuI= X-Google-Smtp-Source: ABdhPJx70rMqMY04MQovrInKhBtdK5YGHbU+7WFX3giIXBncTqjOyq+TRC1kPaRQBjbdDUahzRKwBg== X-Received: by 2002:a17:902:d2c1:b029:128:d851:77fc with SMTP id n1-20020a170902d2c1b0290128d85177fcmr15884463plc.23.1625553473101; Mon, 05 Jul 2021 23:37:53 -0700 (PDT) Received: from [192.168.1.22] (c-73-202-182-183.hsd1.ca.comcast.net. [73.202.182.183]) by smtp.gmail.com with ESMTPSA id j15sm1562072pjn.28.2021.07.05.23.37.52 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 05 Jul 2021 23:37:52 -0700 (PDT) From: "Kiran Makhijani" To: "Michael Richardson" , iotops@ietf.org, lijun.dong@futurewei.com Date: Tue, 06 Jul 2021 06:37:51 +0000 Message-Id: In-Reply-To: <8742.1624305316@localhost> References: <8742.1624305316@localhost> Reply-To: "Kiran Makhijani" User-Agent: eM_Client/8.2.1473.0 Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Iotops] Fw: I-D Action: draft-km-industrial-internet-requirements-00.txt X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jul 2021 06:38:00 -0000 Hello Micheal, Apologies for late reply. I did not see this up until now. Please see=20 inline [KM]. ------ Original Message ------ From: "Michael Richardson" To: "Kiran M (ietf)" ; iotops@ietf.org;=20 lijun.dong@futurewei.com Sent: 6/21/2021 12:55:16 PM Subject: Re: [Iotops] Fw: I-D Action:=20 draft-km-industrial-internet-requirements-00.txt > >Kiran M (ietf) wrote: > > Title : Requirements and Scenarios for Industry Internet= Addressing > > Authors : Kiran Makhijani > > Lijun Dong > > Filename : draft-km-industrial-internet-requirements-00.txt > > Pages : 13 > > Date : 2021-06-10 > >Thank you for the interesting document. >If you ran it through xml2rfc --v2v3 mydraft.xml and submitted "mydraft.v2= v3.xml" >then you'd get the way more readable HTML generated as well the traditiona= l TXT. > [KM] OK, will do. I can generate a readable html file locally, will try=20 to upload generated -v2v3.xml. > > > Abstract: > > Industry Control Networks host a diverse set of non-internet > > protocols for different purposes. Even though they operate in a > > controlled environment, one end of industrial control applications > > run over internet technologies (IT) and another over operational > > technology (OT) protocols. This memo discusses the challenges and > > requirements relating to converegence of OT and IT networks. One > > particular problem in convergence is figuring out reachability > > between the these networks. > >About: Modbus, Profibus, CANbus, Profinet, etc. >I understood that more and more these are running over "Ether/IP", which m= any >of us just call IP. This eliminates the physical connectivity challenges= , >but opens up significant risk due to converged network and addressing. > > [KM] That is right. Most of this protocols are over IP when they talk to = IT-world applications and services. Certainly security is one aspect and i= s a challenge for both the cases - when applications are outside a site or= on-site. Today, only form of protection we have is through firewalls. But= there is an operational aspect to it as well in which communication betwee= n different bus protocols is pretty expensive and indirect (having to go th= rough encap/decap over IP) or proprietary. For the sake of automation, impr= ovements in inter-operation mechanisms can simplify factory operations by r= educing gateway configurations. > >In the automotive space, ethernet (10baseT1S) seems to poised to win over >CANbus. My observation is that the question is which year will it win, >rather than if. Are you seeing CANbus used outside the automobile itself, = in >industrial settings? (Do automotive plants use CANbus in the factory?) > [KM] Yes, ethernet will see higher adoption overtime. But industry=20 control networks are legacy networks, there is a certain level of=20 comfort and confidence in fieldbus technologies. Functionally, the=20 behavior for many devices is easily satisfied by I/O bus interfaces. =20 Unfortunately, I don't have a clear answer to use of CANbus in the=20 factory. But we can still safely assume that the number of protocols in=20 industry control are quite high and will remain that way. > >It feels like your document ended just as it was getting into the question >you ask about how to arrange connectivity, addressing, etc. >Is there more to your document that you had in mind to write? >It's hard to know what your next step in the document would be. > [KM] I looked at Industry control problem from service and connectivity=20 aspect. As of now i believe the services related work should be in=20 DETNET territory. the second part - providing a standard and efficient=20 form of inter-protocol connection on a factory floor can be discussed in=20 Iotops. > >Some thoughts I have are: > >1) the XYZ-over-IP would be best if they were either XYZ-over-TLS, or perh= aps > XYZ-over-QUIC. Sprinkle in DETNET as needed. QUIC eliminates > head-of-queue blocking issues, and so allows for higher priority comma= nds > to pass lower priority ones in the queue. > {Of course, it should have been XYZ-over-SCTP-over-IPsec, and it could = be > so in a greenfield plant, but mindshare is not there} > > The challenge in the TLS based AKE is that we have to get the certific= ates > installed, and then we have to arrange for mutual trust. > I think that OPC UA currently deals with this kind of thing in it's > configuration model, but I'm not priviledged to see those documents. > (You may be?) > > Is that a gap you are interesting in? [KM] It will be great to have a discussion on the transport and=20 security of industry control operations. I think OPC-UA does have TLS=20 support between the application and a server in the factory - But I=20 would guess that it does not extend all the way to end devices (simply=20 because fieldbus devices only perform I/O commands and do not have=20 sophisticated transport). > > >2) since many of the other protocols use significant shorter identifiers, > creating an overlay spec that embeds them in IPv6 IIDs would be > interesting. > > This would allow IP based controllers to address Modbus, profibus, > profinet, sensors/actuators directly, and if the underlying gateways a= nd > wiring allows, in a stateless way. > Stateless is good because it means that the redundancy in the wiring c= an > be exploited. > > This would be interesting work, but probably the IETF does not have th= e > right people here (AT THIS TIME), to make progress on that. > [KM] Hmm, that's fair to certain extent. But , the IPv6 IID design type= of expertise is very much here in the IETF. There are also other things of= industry control relating to long-term use cases (I tried to avoid those in = first draft) but we can talk about which ones are interesting to the group= . [KM] Thanks for the feedback. I will modify the document to make it=20 clearer for more discussion. >-Kiran >-- >Michael Richardson . o O ( IPv6 I=C3=B8T consult= ing ) > Sandelman Software Works Inc, Ottawa and Worldwide From nobody Tue Jul 6 06:44:22 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06BFF3A286F for ; Tue, 6 Jul 2021 06:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aM2ROheHt4uN for ; Tue, 6 Jul 2021 06:44:15 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 716A73A2865 for ; Tue, 6 Jul 2021 06:44:15 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 5441238A60; Tue, 6 Jul 2021 09:46:41 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 4JtXSoYRR51b; Tue, 6 Jul 2021 09:46:37 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 8B0F1389F1; Tue, 6 Jul 2021 09:46:37 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 792A42B3; Tue, 6 Jul 2021 09:44:09 -0400 (EDT) From: Michael Richardson To: "Kiran Makhijani" , iotops@ietf.org, lijun.dong@futurewei.com In-Reply-To: References: <8742.1624305316@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] Fw: I-D Action: draft-km-industrial-internet-requirements-00.txt X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jul 2021 13:44:20 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Kiran Makhijani wrote: >> It feels like your document ended just as it was getting into the qu= estion >> you ask about how to arrange connectivity, addressing, etc. >> Is there more to your document that you had in mind to write? >> It's hard to know what your next step in the document would be. > [KM] I looked at Industry control problem from service and connectivi= ty > aspect. As of now i believe the services related work should be in DE= TNET > territory. the second part - providing a standard and efficient form = of > inter-protocol connection on a factory floor can be discussed in > Iotops. So DETNET can clearly provide the layer 1/2 guarantees for deliverary/latency. But I think that depth in security needs each communication security. > [KM] It will be great to have a discussion on the transport and secu= rity of > industry control operations. I think OPC-UA does have TLS support bet= ween the > application and a server in the factory - But I would guess that it = does not > extend all the way to end devices (simply because fieldbus devices on= ly > perform I/O commands and do not have sophisticated transport). It extends across the Ether/IP, but no, I don't think that they are considering object security across the fieldbus. CoAP could be run with EDHOC to key it giving session security, but in many cases object security would be better. >> 2) since many of the other protocols use significant shorter identif= iers, >> creating an overlay spec that embeds them in IPv6 IIDs would be >> interesting. >> >> This would allow IP based controllers to address Modbus, profibus, >> profinet, sensors/actuators directly, and if the underlying gateways= and >> wiring allows, in a stateless way. >> Stateless is good because it means that the redundancy in the wiring= can >> be exploited. >> >> This would be interesting work, but probably the IETF does not have = the >> right people here (AT THIS TIME), to make progress on that. KM> Hmm, that's fair to certain extent. But , the IPv6 IID design type = of KM> expertise is very much here in the IETF. There are also other things KM> of industry control relating to long-term use cases (I tried to avo= id KM> those in first draft) but we can talk about which ones are KM> interesting to the group. Yes, the IID design is here, but not the fieldbus expertise to know what we want to map. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDkXikACgkQgItw+93Q 3WVHLwf9GT2JByFcpHwLTMtNXJ/lwBIe7RV3pnuhrLB2to8G9HxiJAl5g7xXLAvP RbYIP2vTcasTiWeL2qJvplgMK00HkNNQ+vXISIL/bRy1hYplZSzMrFy5Yux3n7pW 5SlJQDgnhYeFNWvjfQjHi4A8q8+CVo/7fa3sHwR9JReG+9IeOK2ha/IdNAqAy8Jl yggZTl0o6I6xnEqg+wNZ9EwH8MKdsM018J/WmLghLPA6ItW7GX7pz0u7aTY6Y6de dPQ9TZTNEcpsQtqPfzxYpRupnbZWxUArMmz1VJwhKixrKti+SptIY5V5H7VC9JLu 45ycnlAxA5js7MJXn2IpfmSmmWXWLg== =XbIm -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jul 9 08:06:06 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7B113A2437 for ; Fri, 9 Jul 2021 08:06:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PHnaPZHkkIrR for ; Fri, 9 Jul 2021 08:06:00 -0700 (PDT) Received: from statler.isode.com (Statler.isode.com [62.232.206.189]) by ietfa.amsl.com (Postfix) with ESMTP id 1ADAF3A2434 for ; Fri, 9 Jul 2021 08:05:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1625843154; d=isode.com; s=june2016; i=@isode.com; bh=Xo300kQDZ8PDrbcXETeBqJHuzEP5xpNB/Yxeo4SXZgo=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=m0tBUzQ6tgiSMf3XAw5Uy91CFB6DfU5XDz5cExeiBAtd6EGsrk38hxcIMA8Zckvoxt4VS7 7XGRNGUq773XsFi9ut0VzxNgRruVI+wPyTyIgBm5FNE5PQFUOL85K44mWY6DxEeNUttIYJ apPM+VeguiEOomDI5rYzKDGb31ozdZc=; Received: from [192.168.1.222] (host5-81-100-22.range5-81.btcentralplus.com [5.81.100.22]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Fri, 9 Jul 2021 16:05:53 +0100 To: iotops@ietf.org From: Alexey Melnikov Message-ID: Date: Fri, 9 Jul 2021 16:05:53 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-GB Archived-At: Subject: [Iotops] Request for agenda topics for IETF 111 X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jul 2021 15:06:05 -0000 Dear WG participants, Please email for your request to present at IETF 111 on July 26th. (If you already emailed chairs, no need to resend your email.) Best Regards, Alexey & Henk From nobody Sun Jul 11 19:03:37 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FFC43A28FB; Sun, 11 Jul 2021 19:03:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W_UaT4kx3khk; Sun, 11 Jul 2021 19:03:30 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AA433A28F7; Sun, 11 Jul 2021 19:03:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id A60343904F; Sun, 11 Jul 2021 21:47:42 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id UnHL9hDMOCBF; Sun, 11 Jul 2021 21:47:26 -0400 (EDT) Received: from sandelman.ca (unknown [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 604EC39053; Sun, 11 Jul 2021 21:47:23 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 9760248B; Sun, 11 Jul 2021 21:44:22 -0400 (EDT) From: Michael Richardson To: opsawg@ietf.org cc: iotops@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Jul 2021 02:03:35 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, I have submitted draft-ietf-opsawg-mud-iot-dns-considerations. I thought that I had previously reported on conversations/feedback that occured from the dnsop WG, at which I presented for IETF110. (I can't find the message in the archives that I wanted to link to, perhaps it was just a dream) The presentation to the DNSOP WG at IETF110 went well, and I think that the group understood the problem. The chairs seemed very happy to have people come to them for advice. The short of it is that many people in the WG felt that it wouldn't work. Even if we did all the things that I've suggested - the MUD Controller and the IoT device doing the same queries to the same DNS server, - respecting TTLs in the MUD controller Due to the unpredictability of cache evictions, one can never be sure that that the DNS server won't have to make a new query, and get a new geofenced answer. I had done some research in preparing this document as to how exactly round robin DNS worked, back when we started doing that ~25 years ago. The people in the WG felt that a) there was never ever any guarantee that browsers would pick the first record to connect to. b) that the set of IPs returned in RR-DNS was never the complete set any= way. (despite what the spec says) c) that modern geo-fenced DNS wasn't going to be consistent... ever. My takeaway from all of this was that essentially... if geofenced/CDNed DNS is not gonna for for IoT devices with MUD files... then maybe the advice about working around them is WRONG. Maybe the right advice is... DON'T DO = THAT. {ME: Doctor! Doctor! It hurts when I use a geographic CDN! Doctor: Don't do that.} The draft update I just posted tries to clear out a few TODO, but mostly I = am going towards that direction. Section 6.4... it's pretty weak at this poin= t. Other than firmware updates, are IoT devices heavy users of geofenced thing= s? I don't think so, but I could be totally wrong here. Where I think that maybe it would be relevant is if I were some OTP video provider, and I sold a tablet designed to do only that. (or if we get into per-App MUD files!). In that case, I might be forced to acceptlist all of my EC3 cloud, and mayb= e that's okay. IPv6 could make this significantly easier, since such an entity could trivially be assigned their own /56 per site, which would be plenty. Or even their own /40, to announce /48s from each geographic location. Name: draft-ietf-opsawg-mud-iot-dns-considerations Revision: 02 Title: Operational Considerations for use of DNS in IoT devices Document date: 2021-07-11 Html: https://www.ietf.org/archive/id/draft-ietf-opsawg-mud-iot-d= ns-considerations-02.html Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-mud-i= ot-dns-considerations-02 =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDrnnYACgkQgItw+93Q 3WWNmAf/TEEDg8ny9HRVW3M2joi871t/yVqnZ5LI6t/Cblvwhm1clKxQw3yOhwDD h7mCohIoajLerKTkkg+9A2MxFknmthU3Nq6Ga1ilRu0kKkpxeFmU6GA0yfad49BM aCsq2DyTw7/L0NfMgEU8EbMmncsWTAHJlRY2p6f0wYqtqkkPRwUzCivuvwY2OnJe /umMvWNGUnBFEWc3pfmSS9x3XkV7LE9ro8KfizfTCXxcMge2Y357hSycBB9niznq gIPJnuOvGJuyzQAjBUrgjjZc+RDhxc+uXrfwyTChTTRlRMuJ0NjzE21sK0ZDjPjP cs3sqSk1SF2DQetmMz4vqNse/KMTNQ== =TtIf -----END PGP SIGNATURE----- --=-=-=-- From nobody Sun Jul 11 22:40:08 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A38133A3477; Sun, 11 Jul 2021 22:40:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.19 X-Spam-Level: X-Spam-Status: No, score=-0.19 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, SPF_PASS=-0.001, T_SPF_HELO_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=lear.ch Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JB50shdMWpRL; Sun, 11 Jul 2021 22:40:02 -0700 (PDT) Received: from upstairs.ofcourseimright.com (upstairs.ofcourseimright.com [185.32.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 954DB3A3479; Sun, 11 Jul 2021 22:39:59 -0700 (PDT) Received: from [IPv6:2a02:aa15:4101:2a80:c010:afee:5c11:271a] ([IPv6:2a02:aa15:4101:2a80:c010:afee:5c11:271a]) (authenticated bits=0) by upstairs.ofcourseimright.com (8.15.2/8.15.2/Debian-18) with ESMTPSA id 16C5dtCK192820 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Mon, 12 Jul 2021 07:39:56 +0200 Authentication-Results: upstairs.ofcourseimright.com; dmarc=none (p=none dis=none) header.from=lear.ch DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=lear.ch; s=upstairs; t=1626068396; bh=SsL3rQdFiW5yMfEKfCH5YMLPp1/jK/e1SfFcrWVDzm0=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=xIT2+2j7QY/GzA5WLDKIrdiX8oXo2C2gmsNSFiW6Zqjcn5UkuVFN79YLfmDRdaVzn 9jCQXFnXUC23K2ZKKZROuklzmjHUvFK9tRZenYuCnl/eTlJ7mWJSolnNC1XncP1Rrh aZRxoFe2qtTrXZBef7LFOF+Dn1T0VEaf58SWdLfA= To: Michael Richardson , opsawg@ietf.org Cc: iotops@ietf.org References: <25526.1626054262@localhost> From: Eliot Lear Message-ID: Date: Mon, 12 Jul 2021 07:39:55 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <25526.1626054262@localhost> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="26BqICtPKo0mbTZbhNK4mgCoQZx0svjuU" Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Jul 2021 05:40:07 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --26BqICtPKo0mbTZbhNK4mgCoQZx0svjuU Content-Type: multipart/mixed; boundary="hhNVqN8wWLosuUqgpFtJbMKP4RpO9rTAM"; protected-headers="v1" From: Eliot Lear To: Michael Richardson , opsawg@ietf.org Cc: iotops@ietf.org Message-ID: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations References: <25526.1626054262@localhost> In-Reply-To: <25526.1626054262@localhost> --hhNVqN8wWLosuUqgpFtJbMKP4RpO9rTAM Content-Type: multipart/alternative; boundary="------------A6D9B79A9BBFDE31A778F371" Content-Language: en-US This is a multi-part message in MIME format. --------------A6D9B79A9BBFDE31A778F371 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable The key issue is that the new query and resolution has to get picked up=20 by the network management system.=C2=A0 So long as that happens, then lif= e is=20 good.=C2=A0 This means that the resolver needs to be integrated with the = MUD=20 manager, but also that the IoT device should also be careful to observe=20 caching semantics, particularly in the case of a connection failure.=20 Those failures will happen with or without MUD. Eliot On 12.07.21 03:44, Michael Richardson wrote: > Hi, I have submitted draft-ietf-opsawg-mud-iot-dns-considerations. > > I thought that I had previously reported on conversations/feedback that= > occured from the dnsop WG, at which I presented for IETF110. > (I can't find the message in the archives that I wanted to link to, > perhaps it was just a dream) > > The presentation to the DNSOP WG at IETF110 went well, and I think that= the > group understood the problem. The chairs seemed very happy to have peo= ple > come to them for advice. > > The short of it is that many people in the WG felt that it wouldn't wor= k. > Even if we did all the things that I've suggested > - the MUD Controller and the IoT device doing the same queries to= the > same DNS server, > - respecting TTLs in the MUD controller > > Due to the unpredictability of cache evictions, one can never be sure t= hat > that the DNS server won't have to make a new query, and get a new geofe= nced > answer. > > I had done some research in preparing this document as to how exactly r= ound > robin DNS worked, back when we started doing that ~25 years ago. > The people in the WG felt that > a) there was never ever any guarantee that browsers would pick the > first record to connect to. > b) that the set of IPs returned in RR-DNS was never the complete se= t anyway. > (despite what the spec says) > c) that modern geo-fenced DNS wasn't going to be consistent... ever= =2E > > > My takeaway from all of this was that essentially... if geofenced/CDNed= DNS > is not gonna for for IoT devices with MUD files... then maybe the advic= e > about working around them is WRONG. Maybe the right advice is... DON'T= DO THAT. > > {ME: Doctor! Doctor! It hurts when I use a geographic CDN! > Doctor: Don't do that.} > > The draft update I just posted tries to clear out a few TODO, but mostl= y I am > going towards that direction. Section 6.4... it's pretty weak at this = point. > > Other than firmware updates, are IoT devices heavy users of geofenced t= hings? > I don't think so, but I could be totally wrong here. > > Where I think that maybe it would be relevant is if I were some OTP vid= eo > provider, and I sold a tablet designed to do only that. (or if we get = into > per-App MUD files!). > In that case, I might be forced to acceptlist all of my EC3 cloud, and = maybe that's okay. > > IPv6 could make this significantly easier, since such an entity could > trivially be assigned their own /56 per site, which would be plenty. > Or even their own /40, to announce /48s from each geographic location. > > Name: draft-ietf-opsawg-mud-iot-dns-considerations > Revision: 02 > Title: Operational Considerations for use of DNS in IoT devices > Document date: 2021-07-11 > Html: https://www.ietf.org/archive/id/draft-ietf-opsawg-mud-i= ot-dns-considerations-02.html > Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-m= ud-iot-dns-considerations-02 > > -- > Michael Richardson . o O ( IPv6 I=C3=B8T cons= ulting ) > Sandelman Software Works Inc, Ottawa and Worldwide > --------------A6D9B79A9BBFDE31A778F371 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

The key issue is that the new query and resolution has to get picked up by the network management system.=C2=A0 So long as that happens, then life is good.=C2=A0 This means that the resolver need= s to be integrated with the MUD manager, but also that the IoT device should also be careful to observe caching semantics, particularly in the case of a connection failure. Those failures will happen with or without MUD.

Eliot

On 12.07.21 03:44, Michael Richardson wrote:
Hi, I have submitted draft-ietf-opsawg-mud-iot-dns-considerations.

I thought that I had previously reported on conversations/feedback that
occured from the dnsop WG, at which I presented for IETF110.
(I can't find the message in the archives that I wanted to link to,
perhaps it was just a dream)

The presentation to the DNSOP WG at IETF110 went well, and I think that t=
he
group understood the problem.  The chairs seemed very happy to have peopl=
e
come to them for advice.

The short of it is that many people in the WG felt that it wouldn't work.=

Even if we did all the things that I've suggested
     - the MUD Controller and the IoT device doing the same queries to th=
e
       same DNS server,
     - respecting TTLs in the MUD controller

Due to the unpredictability of cache evictions, one can never be sure tha=
t
that the DNS server won't have to make a new query, and get a new geofenc=
ed
answer.

I had done some research in preparing this document as to how exactly rou=
nd
robin DNS worked, back when we started doing that ~25 years ago.
The people in the WG felt that
   a) there was never ever any guarantee that browsers would pick the
      first record to connect to.
   b) that the set of IPs returned in RR-DNS was never the complete set a=
nyway.
      (despite what the spec says)
   c) that modern geo-fenced DNS wasn't going to be consistent... ever.


My takeaway from all of this was that essentially... if geofenced/CDNed D=
NS
is not gonna for for IoT devices with MUD files... then maybe the advice
about working around them is WRONG.  Maybe the right advice is... DON'T D=
O THAT.

{ME: Doctor! Doctor! It hurts when I use a geographic CDN!
 Doctor: Don't do that.}

The draft update I just posted tries to clear out a few TODO, but mostly =
I am
going towards that direction.  Section 6.4... it's pretty weak at this po=
int.

Other than firmware updates, are IoT devices heavy users of geofenced thi=
ngs?
I don't think so, but I could be totally wrong here.

Where I think that maybe it would be relevant is if I were some OTP video=

provider, and I sold a tablet designed to do only that.  (or if we get in=
to
per-App MUD files!).
In that case, I might be forced to acceptlist all of my EC3 cloud, and ma=
ybe that's okay.

IPv6 could make this significantly easier, since such an entity could
trivially be assigned their own /56 per site, which would be plenty.
Or even their own /40, to announce /48s from each geographic location.

Name:		draft-ietf-opsawg-mud-iot-dns-considerations
Revision:	02
Title:		Operational Considerations for use of DNS in IoT devices
Document date:	2021-07-11
Html:           h=
ttps://www.ietf.org/archive/id/draft-ietf-opsawg-mud-iot-dns-consideratio=
ns-02.html
Diff:           ht=
tps://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-mud-iot-dns-considera=
tions-02

--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 I=C3=B8=
T consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

--------------A6D9B79A9BBFDE31A778F371-- --hhNVqN8wWLosuUqgpFtJbMKP4RpO9rTAM-- --26BqICtPKo0mbTZbhNK4mgCoQZx0svjuU Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmDr1asFAwAAAAAACgkQh7ZrRtnSejNn 9ggAiMzzGLFGW0DCpMRXEpKzg7vpCxYvmzFxwHW7fmxrHqUwUV3NlKTZSOYRmyl72pWWQeaep/g7 W0Z1YBVdFtbGBCl6X3fJjcFDkZzpePgKIGCZWuupOwK0ASEFAIJLohL9j9lutOYntkHziRg3rJUs rYgyZiXAAO1Kh33J1wBFqxlMUgjhibGjPBMLgtPiFaVyzbLVm5yB1fqVzTrPVhzuTa4Xf+fcyvRh 9SWapy3lXu7TOmVeuYi2OQ0foQ0Cu77hyWDHvHmmJ/HO0wVKCX++Wb7bmxkdhh/p1X6ibzv1rfTB SQCWltXV/7HfZywgpMkgKc9do4pK1Ng0J9K+BTs0tQ== =B5Fg -----END PGP SIGNATURE----- --26BqICtPKo0mbTZbhNK4mgCoQZx0svjuU-- From nobody Mon Jul 12 03:59:37 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E699D3A163B; Mon, 12 Jul 2021 03:59:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QW76zesykWDl; Mon, 12 Jul 2021 03:59:30 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F8263A1634; Mon, 12 Jul 2021 03:59:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id BD79038A5E; Mon, 12 Jul 2021 07:02:16 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id S_mnISVRthNu; Mon, 12 Jul 2021 07:02:13 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 5AC3538A56; Mon, 12 Jul 2021 07:02:13 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 619D3EA; Mon, 12 Jul 2021 06:59:23 -0400 (EDT) From: Michael Richardson To: Eliot Lear , opsawg@ietf.org, iotops@ietf.org In-Reply-To: References: <25526.1626054262@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Jul 2021 10:59:35 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Eliot Lear wrote: > The key issue is that the new query and resolution has to get picked = up > by the network management system.=C2=A0 So long as that happens, then= life > is good.=C2=A0 This means that the resolver needs to be integrated w= ith the > MUD manager, but also that the IoT device should also be careful to > observe caching semantics, particularly in the case of a connection > failure. I agree that having a MUD-aware caching resolver can solve the problem. It might be practical in some places for the MUD-aware network management system to control DHCP, and be able to tell the IoT devices what DNS server to use. I don't have a problem writing this kind of advice, but it's no longer advi= ce to the IoT device creator, but the Enterprise operator of the MUD system. > Those failures will happen with or without MUD. Please explain: how do we see inconsistent application of DNS based rules without MUD? >> My takeaway from all of this was that essentially... if >> geofenced/CDNed DNS is not gonna for for IoT devices with MUD >> files... then maybe the advice about working around them is WRONG. >> Maybe the right advice is... DON'T DO THAT. >> >> {ME: Doctor! Doctor! It hurts when I use a geographic CDN! Doctor: >> Don't do that.} =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDsIIoACgkQgItw+93Q 3WV5jQf+I8Do2+yuUvir6w3Ox/8Abpe8Vt5m0x0i/sIYJorQXtnXgutDrAKAZK8N QEWB2i+foHplufIhIEgwlw9j5sieQ1xq7Ff+vulMDeTyVVdREg4SKypYnxf1L+xF u0cwxOyXSAU9EX9D+iDrrMgiH53ZZUt1g4C83vLt0Ilt0poYn4V0QTKG85aSWy7R GG7DUKc9qsKbLXkTyvp4LqTmRUcraRHbyhwXvMFLsvGoQqP2h0HlhhLDxjRoTKVt W3kHbcwBCchJ9NLc24JsIf2Em/ZVgesoo/YDX+o45WUH5ooVCgnmMTjRoeqxGgSL YQVfbNGzfQSxZKhyskVsfdM9IPmtWg== =aci4 -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Jul 12 04:41:43 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12C2B3A0E90; Mon, 12 Jul 2021 04:41:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.31 X-Spam-Level: * X-Spam-Status: No, score=1.31 tagged_above=-999 required=5 tests=[DKIM_ADSP_ALL=1.1, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SPF_HELO_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=lear.ch Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CmBsybQhyNTy; Mon, 12 Jul 2021 04:41:26 -0700 (PDT) Received: from upstairs.ofcourseimright.com (upstairs.ofcourseimright.com [185.32.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 873B53A0EB5; Mon, 12 Jul 2021 04:41:21 -0700 (PDT) Received: from [IPv6:2001:420:c0c0:1003::338] ([IPv6:2001:420:c0c0:1003:0:0:0:338]) (authenticated bits=0) by upstairs.ofcourseimright.com (8.15.2/8.15.2/Debian-18) with ESMTPSA id 16CBfHIA196399 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Mon, 12 Jul 2021 13:41:18 +0200 Authentication-Results: upstairs.ofcourseimright.com; dmarc=none (p=none dis=none) header.from=lear.ch DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=lear.ch; s=upstairs; t=1626090078; bh=6dqDiVnv/Ey38C6RF22BkEuFxHwt4B99PuBs6f9TAoc=; h=Subject:To:References:From:Date:In-Reply-To:From; b=SzXgkqvEJKAA2JXAtWQt5+jwFajEcLKgYha/j26px0afcFUzmvPIdOnCz5sxiggn5 eeinP8+59AtkCw8OICDoGn3DLboHPWlV56OytLcCd6ihshgg4Mm/fQLgzviDzs5aOz oSCsK/WSSLbzCIHyoSBk8kVs9lEp55tVKNCn8zCY= To: Michael Richardson , opsawg@ietf.org, iotops@ietf.org References: <25526.1626054262@localhost> <16936.1626087563@localhost> From: Eliot Lear Message-ID: <7f5433bb-0a8a-451b-f325-7e4ce21d5972@lear.ch> Date: Mon, 12 Jul 2021 13:41:14 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <16936.1626087563@localhost> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="5Vh4IXheyK1mAqPmlxobkdoCmJDnED1Is" Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Jul 2021 11:41:39 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5Vh4IXheyK1mAqPmlxobkdoCmJDnED1Is Content-Type: multipart/mixed; boundary="ySrY9SuANumg41mCICBB7aCMyuMNo7YtY"; protected-headers="v1" From: Eliot Lear To: Michael Richardson , opsawg@ietf.org, iotops@ietf.org Message-ID: <7f5433bb-0a8a-451b-f325-7e4ce21d5972@lear.ch> Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations References: <25526.1626054262@localhost> <16936.1626087563@localhost> In-Reply-To: <16936.1626087563@localhost> --ySrY9SuANumg41mCICBB7aCMyuMNo7YtY Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Content-Language: en-US > > Those failures will happen with or without MUD. > > Please explain: how do we see inconsistent application of DNS based rul= es > without MUD? What I meant in context was that there could be NAT binding timeouts and = the like, but there are systems out there that do keep context based on=20 name resolution. Eliot --ySrY9SuANumg41mCICBB7aCMyuMNo7YtY-- --5Vh4IXheyK1mAqPmlxobkdoCmJDnED1Is Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmDsKloFAwAAAAAACgkQh7ZrRtnSejPH 9Qf+IZINjbBgA6NnctEc+CJPfQ0ShIg+Ey+PKmmsxTEFXsDcuvN3fVo4jOm5xKgRinPfrfhAeceE c4U/cbgb2VuwyNMZlfVve1/KiTWIcLOHlcq/mK30JBbk+Pa/nvg2q5oZDpuHwka9yVWZTngAoNZ3 v+Qi9QUBcngX+A9iI3N46zPaCrOjcv25Phha0AsOYEYDsc7DOud7jUeeJ1ee0uXFEPagC83GT5S0 K5Hfguz7JLZkZdiIJI9xcx5JXnVTUDC7QGGdYVaNFam+/Tbblu8THYoUMOle6PP8E+z4FBZD21mF AdsAP9pSc5ZtxneB+ETsoIstrB1HV0jE922vFIbF8A== =utH5 -----END PGP SIGNATURE----- --5Vh4IXheyK1mAqPmlxobkdoCmJDnED1Is-- From nobody Tue Jul 13 13:42:54 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5E823A0840 for ; Tue, 13 Jul 2021 13:42:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.118 X-Spam-Level: X-Spam-Status: No, score=-1.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EnNckxojziZq for ; Tue, 13 Jul 2021 13:42:48 -0700 (PDT) Received: from faui40.informatik.uni-erlangen.de (faui40.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B96073A083E for ; Tue, 13 Jul 2021 13:42:48 -0700 (PDT) Received: from faui48e.informatik.uni-erlangen.de (faui48e.informatik.uni-erlangen.de [131.188.34.51]) by faui40.informatik.uni-erlangen.de (Postfix) with ESMTP id 04A81549DA2 for ; Tue, 13 Jul 2021 22:42:43 +0200 (CEST) Received: by faui48e.informatik.uni-erlangen.de (Postfix, from userid 10463) id F2A564E7A2A; Tue, 13 Jul 2021 22:42:42 +0200 (CEST) Date: Tue, 13 Jul 2021 22:42:42 +0200 From: Toerless Eckert To: iotops@ietf.org Message-ID: <20210713204242.GA42786@faui48e.informatik.uni-erlangen.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: [Iotops] FYI: draft-eckert-intarea-functional-addr-internets-00.txt X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2021 20:42:53 -0000 Dear Iotops WG I published yesterday subject draft to describe addressing problems with existing IP addressing, an proposing a solution. https://datatracker.ietf.org/doc/draft-eckert-intarea-functional-addr-internets/ Many of the probems mentioned exist in what i think is IoT, but not necessarily "constrained" IoT, but rather industrial or transportation IoT. So i think at least the problem, but maybe also the solution part of the draft could be of some interest to iotops, and i would be happy about comments and/or interest in it. On Mon, Jul 12, 2021 at 01:00:25PM -0700, internet-drafts@ietf.org wrote: > A new version of I-D, draft-eckert-intarea-functional-addr-internets-00.txt > has been successfully submitted by Toerless Eckert and posted to the > IETF repository. > > Name: draft-eckert-intarea-functional-addr-internets > Revision: 00 > Title: Functional Addressing (FA) for internets with Independent Network Address Spaces (IINAS) > Document date: 2021-07-12 > Group: Individual Submission > Pages: 30 > URL: https://www.ietf.org/archive/id/draft-eckert-intarea-functional-addr-internets-00.txt > Status: https://datatracker.ietf.org/doc/draft-eckert-intarea-functional-addr-internets/ > Htmlized: https://datatracker.ietf.org/doc/html/draft-eckert-intarea-functional-addr-internets > > > Abstract: > Recent work has raised interest in exploring network layer addressing > that is more flexible than fixed-length addressing as used in IPv4 > (32 bit) and IPv6 (128 bit). > > The reasons for the interest include both support for multiple and > potentially novel address semantics, but also optimizations of > addressing for existing semantics such as unicast tailored not for > the global Internet but to better support private networks / limited > domains. > > This memo explores in the view of the author yet little explored > reasons for more flexible addresses namely the problems and > opportunities for Internetworking with Independent Network Address > Spaces (IINAS). > > To better enable such internetworks, this memo proposes a framework > for a Functional Addressing model. This model also intends to > support several other addressing goals including programmability and > multiple semantics. > > > > > The IETF Secretariat From nobody Wed Jul 14 12:24:58 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BB923A15C6; Wed, 14 Jul 2021 12:24:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id diTU66qLn_2x; Wed, 14 Jul 2021 12:24:48 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B85543A15C8; Wed, 14 Jul 2021 12:24:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 0BDCC38A91; Wed, 14 Jul 2021 15:27:43 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id nDNDwJz4g8hQ; Wed, 14 Jul 2021 15:27:39 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id D7BBF38A90; Wed, 14 Jul 2021 15:27:38 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 41003486; Wed, 14 Jul 2021 15:24:40 -0400 (EDT) From: Michael Richardson To: iotops@ietf.org cc: madinas@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Iotops] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2021 19:24:53 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I'm not sure where the madinas charter is, the _MADINAS - Proposed Charter v2_ thread from the end of May petered out. I don't see a charter in the WG/BOF entry on the datatracker. A BCP document is mentioned. I think that a BCP document on IoT devices, including routers, switches and other infrastructure would be good. The short of it, for me, is that a) wired interfaces for non-movable things (home gateways, fridges, furnaces) should not change their MAC address. (Whether they use OUI derived addresses is a second question) b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT devices, that they should always use the same MAC address for the same ESSID. Combining (a) and (b), I'm fine if wired devices that do 802.1x want to do RCM. That would apply to many security paranoid enterprise desktops/laptops. But, I don't think that the IDS systems will be ready for a long time, as they mostly haven't caught up to IPv6 Temporary addresses y= et. It's probably five pages of justification for each point I make above, sigh. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDvOfcACgkQgItw+93Q 3WUJ/AgAtAl3xEpZcwoJaHhpZBpdYLAqoFazdYScjvb+QH9KOWwSjMgF+2nwBv18 Wsn2jYktDVfWuOGVuV3O+Rr+LMhFVHcNnmstWYc4meQzufTODfKGSSPtTbTXGAQA lA0mPBM3om9wzOYMF9CtekMWBy1+HoGVTo6cX38Uk5UNwwg77c42zsn7/deQOgkM X+byyzbNKQsgjEryXVGgs6mg5tvRlEtDtO+LWWvS0COVkAqWJ+GvjcB6Oo6/fDsA QsE1Pf78UCH7393qjUILlDSmMzsjWt57vhLsGGfxR5o67FHwNjD0iWjimTN1t/0g owvJ34HAzYCVPFX5uMunBJcJpIDSvg== =tV9g -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 14 13:06:43 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E33DF3A178B; Wed, 14 Jul 2021 13:06:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J6hC2AALPqfH; Wed, 14 Jul 2021 13:06:39 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F9143A1789; Wed, 14 Jul 2021 13:06:34 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id f93-20020a9d03e60000b02904b1f1d7c5f4so3758037otf.9; Wed, 14 Jul 2021 13:06:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZNQDLAUT4wOoXSoQKF2QCDhPvlUdYRd2ZY0K13Xwewc=; b=r1X28QCqFJymhqNA5QsKvBkDVv9Af6zUaL8kk9O6mks2EfV7cgAvfpIwxxp6oqjca/ sPLgzxBzFzaZUt4ehQv8uwwqSiIqTfJb79Uclbdn3tehzdq0+QriMtTdAEMRi2sn4jDd ts25frfQY83iJC7H5gTpJ5CgkSbCt/WSJ2JZb2B7LUvk+74eiC1ruov6OzOh5Ypzfavm Mqa7DJXQslFUL2Fvrhqo5SMU/HkKpfwxLkInHR+pEAMSDyW3JYmCmNiXXj2gOtLcU46P 7OhEqZ0soAgvtsMloTaXt6vvxPcTlpA+IQfEcjQ75W5Yfd52sZuxhXhtQDeD4trR+1Pc 8hYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZNQDLAUT4wOoXSoQKF2QCDhPvlUdYRd2ZY0K13Xwewc=; b=a3ya2a9BWksuNUICay/DUWp4Y348AIFQuQcIeikEQ1Zh8dm5XkFbrvqeYLfGWW9vda Ozy+6cxpdr6MCnh3+LUd+P+k17SVROrZy6zRDvVRCPlJ/k3C/kC+93r6+22SX1bhkVyl MrZzc570VJZ7wwWIxF7zXTqezscB56Bi8JMP5yzGNwnwMGDrtBzjXXZV/sfXyBGDBxNb 3aU/0fuzAQPGx2kLHSZuFOS4efbG+0lJpzCkgqTVYDHPdXJQ2iX2BRJHfHpWh1GK6lbj A+b8kIk7+2Ls2I/I5TmO+Yn3JZOoCrC2NcfpVSE2wM6TGYDFRh4cqwHeAxqVt9+x+5XC lA8A== X-Gm-Message-State: AOAM530WebEpUdog4HvL5/y6MKHv18Iqzj58KWxH1xOKFoBwiHRIjIWS EEZFHE/Lx3zVWs3oxbuOttZn4iCwqqhXapXWReew3G4j X-Google-Smtp-Source: ABdhPJxEwc7Ww/hnFjPGpwnBVZzrCO3K8+dpoaTreF+GTxKV+UAUQ5EB/7S1SSTfymra6ocGTZIbYAYu/DddfvVM7aM= X-Received: by 2002:a9d:5a18:: with SMTP id v24mr9392519oth.191.1626293191652; Wed, 14 Jul 2021 13:06:31 -0700 (PDT) MIME-Version: 1.0 References: <2660.1626290680@localhost> In-Reply-To: <2660.1626290680@localhost> From: Erik Kline Date: Wed, 14 Jul 2021 13:06:20 -0700 Message-ID: To: Michael Richardson Cc: iotops@ietf.org, madinas@ietf.org Content-Type: multipart/alternative; boundary="000000000000fd398905c71ae365" Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2021 20:06:42 -0000 --000000000000fd398905c71ae365 Content-Type: text/plain; charset="UTF-8" > > b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT > devices, that they should always use the same MAC address for the > same ESSID. > I suspect there's more to discuss or clarify here including, for example, lifetime/session issues. Consider an owner/admin clicking the equivalent of "forget this network" and reassociating to the same ESSID. I'd expect a new MAC could easily be justified by devices that do RCM for privacy reasons. --000000000000fd398905c71ae365 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
=C2=A0 b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquit= ous among wifi IoT
=C2=A0 =C2=A0 =C2=A0devices, that they should always use the same MAC addre= ss for the
=C2=A0 =C2=A0 =C2=A0same ESSID.

I suspe= ct there's more to discuss or clarify here including, for=C2=A0example,= lifetime/session issues.=C2=A0 Consider an owner/admin clicking the equiva= lent of "forget this network" and reassociating to the same ESSID= .=C2=A0 I'd expect a new MAC could easily be justified by devices that = do RCM for privacy reasons.
--000000000000fd398905c71ae365-- From nobody Wed Jul 14 14:12:37 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B72763A0CBD; Wed, 14 Jul 2021 14:12:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gcZxIh6poVb1; Wed, 14 Jul 2021 14:12:30 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBB673A0CB4; Wed, 14 Jul 2021 14:12:29 -0700 (PDT) Received: from [192.168.46.129] (24-52-251-6.cable.teksavvy.com [24.52.251.6]) by mail.networkradius.com (Postfix) with ESMTPSA id 1AC31389; Wed, 14 Jul 2021 21:12:26 +0000 (UTC) Authentication-Results: NetworkRADIUS; dmarc=none (p=none dis=none) header.from=deployingradius.com Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) From: Alan DeKok In-Reply-To: <2660.1626290680@localhost> Date: Wed, 14 Jul 2021 17:12:25 -0400 Cc: iotops@ietf.org, madinas@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <04DE814C-BB42-4039-9172-826EBE5AE473@deployingradius.com> References: <2660.1626290680@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3608.120.23.2.7) Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2021 21:12:36 -0000 On Jul 14, 2021, at 3:24 PM, Michael Richardson = wrote: > I think that a BCP document on IoT devices, including routers, > switches and other infrastructure would be good. I agree. > The short of it, for me, is that > a) wired interfaces for non-movable things (home gateways, fridges, > furnaces) should not change their MAC address. (Whether they use > OUI derived addresses is a second question) >=20 > b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT > devices, that they should always use the same MAC address for the > same ESSID. It's probably fine to change it periodically. Right now, IIRC it's 24 = hours for most vendors. > Combining (a) and (b), I'm fine if wired devices that do 802.1x want = to do > RCM. That would apply to many security paranoid enterprise > desktops/laptops. But, I don't think that the IDS systems will be = ready for > a long time, as they mostly haven't caught up to IPv6 Temporary = addresses yet. If devices do 802.1X, then the authenticator can already identify the = device. The question then is which part of the network should be seen = as untrusted? If the device is roaming, then it makes sense to hide it's identity = from the visited network. It's also useful to hide the device identity = on public WiFi frames. But once 802.1X is done, the link to the AP is = secure. And the device usually might as well use it's own, physical MAC = address. Alan DeKok. From nobody Thu Jul 15 04:53:13 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A9F23A2872; Thu, 15 Jul 2021 04:53:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.1 X-Spam-Level: X-Spam-Status: No, score=-7.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PMNpCeezi6bv; Thu, 15 Jul 2021 04:53:05 -0700 (PDT) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CDA33A2870; Thu, 15 Jul 2021 04:53:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=Content-Type:MIME-Version:Date:Message-ID:Subject:From:Cc:To ; bh=E4H/9TNp2SDRLZaVSnFGPFWmd/3cNLSQqrLgLyNqJRs=; b=MFDIsPijZfhYd2h02/c4MkKu MHUu5VTiIpRho6RA/a8zFFpYer5ZF28QHH8A3sH3d0fzH5HkqWiv1gPxhx5kosoyoeCv3Jdk7im5c jeFDLErORUj0aNYkHsMaD9asSWhlFF7wiu4KpTjdE+4an8Rn13pFLkEQJ4tr6CYkYnpxSeQNaIqNn bLpdMwtTHxOIRAASMuhs5ADbJ3tqUF1ZJdHNAhtvl2rn5P8lLsNbh/fU6UODArLnMb+hCbNH2/od1 D/1olMWOSweTRQQ7Y5xB5dOzdPNDEszepe+lj3pJBpw/obpu3DwX+xBmPw6bgK0+u80n3QeuIRR1u HAlIMLxZvg==; Received: from bufobufo.ripe.net ([2001:67c:2e8:23::c100:170d]:37902) by molamola.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1m3zvI-0001WX-IS; Thu, 15 Jul 2021 13:53:00 +0200 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=[IPv6:2001:67c:2e8:1200::5ca]) by bufobufo.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1m3zvI-0005Ct-FT; Thu, 15 Jul 2021 13:53:00 +0200 To: Michael Richardson , opsawg@ietf.org Cc: iotops@ietf.org References: <25526.1626054262@localhost> From: Robert Kisteleki Organization: RIPE NCC Message-ID: <217fef5b-4721-cc38-0df8-0ddadb8421e6@ripe.net> Date: Thu, 15 Jul 2021 13:53:00 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <25526.1626054262@localhost> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 8bit X-RIPE-Signature: 72e00e6d7601fa19264e98abc238a274fb812cb2de1efba7ddd0220f769500b2 Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 11:53:11 -0000 Hi, > Due to the unpredictability of cache evictions, one can never be sure that > that the DNS server won't have to make a new query, and get a new geofenced > answer. I believe it's not only about geofenced answers, but answers in general. Maybe because of geofencing, maybe for other reasons. > My takeaway from all of this was that essentially... if geofenced/CDNed DNS > is not gonna for for IoT devices with MUD files... then maybe the advice > about working around them is WRONG. Maybe the right advice is... DON'T DO THAT. "Do or do not. There is no try." :-) > {ME: Doctor! Doctor! It hurts when I use a geographic CDN! > Doctor: Don't do that.} Yet people do use it, and in many cases for good reasons! > Other than firmware updates, are IoT devices heavy users of geofenced things? > I don't think so, but I could be totally wrong here. It is probably not a major use case, but it's possible that the principle applies in other contexts too: RIPE Atlas (which is, according to some, can be considered IoT as well) in some cases uses DNS lookups to figure our measurement targets. The TTL on those is really low. Robert From nobody Thu Jul 15 04:53:45 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51A773A2874; Thu, 15 Jul 2021 04:53:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vCwkofgQIlPm; Thu, 15 Jul 2021 04:53:34 -0700 (PDT) Received: from mahimahi.ripe.net (mahimahi.ripe.net [IPv6:2001:67c:2e8:11::c100:1372]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 344063A2872; Thu, 15 Jul 2021 04:53:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ripe.net; s=s1-ripe-net; h=Content-Type:MIME-Version:Date:Message-ID:Subject:From:Cc:To ; bh=+LO4Dd9Q76vOJstRguBTxPVkZflEylR6kgp3i1gnjpE=; b=IpkZgbOg9hDVr+EcZOEU+kUJ VblXHKKw6tV7x6KNmVn2Ee4KVo0Bn05ZfOZUJuoMapPd8GBzuz07MzOYwyXrshI5nnmO2DF45dON0 lAyYYqFJRUhGeFTDA7/JCJAjgeDsSprkOxbNRHKFVaf59SEE7+omtE0eao6OK5pf3sMq0PoZRJYvn c5dcd3y5f7oC/Seb2FtuLwNEFDMLbQohyAqhCUBcLtRsxXG74sL6SHgq9VxqlIF1N7NUO7z0eSOpM iFEs9sJkD86EtbAbenSJArlhpbirOMDnVW0g2JG8FuB35EeOY+wfLVI+kEirkEOZJr2WnihGM+qRz rq20S4Rz0Q==; Received: from bufobufo.ripe.net ([2001:67c:2e8:23::c100:170d]:46084) by mahimahi.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1m3zvm-0000NC-U2; Thu, 15 Jul 2021 13:53:30 +0200 Received: from sslvpn.ipv6.ripe.net ([2001:67c:2e8:9::c100:14e6] helo=[IPv6:2001:67c:2e8:1200::5ca]) by bufobufo.ripe.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1m3zvm-0005El-Os; Thu, 15 Jul 2021 13:53:30 +0200 To: Eliot Lear , opsawg@ietf.org Cc: iotops@ietf.org References: <25526.1626054262@localhost> From: Robert Kisteleki Organization: RIPE NCC Message-ID: Date: Thu, 15 Jul 2021 13:53:30 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 8bit X-RIPE-Signature: 72e00e6d7601fa19264e98abc238a2745df52f8eb07d892d2cfeca59e5a6bce3 Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 11:53:40 -0000 > This means that the resolver needs to be integrated with the MUD > manager I think you're right. However, we also know this kind of bundling is not always a good idea, or even favourable. Like an init system that has a built-in network manager, DNS resolver or MUD controller :-) > but also that the IoT device should also be careful to observe > caching semantics, particularly in the case of a connection failure. Doesn't that prescribe that the IoT devices "should behave correctly"? Because we all know in reality they do not, at least not always -- but then what is a MUD controller supposed to do? Work around? Cover potential bad cases? Ignore this? Robert From nobody Thu Jul 15 05:33:34 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 747BA3A0D04; Thu, 15 Jul 2021 05:33:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eoNwIg4H1nWB; Thu, 15 Jul 2021 05:33:27 -0700 (PDT) Received: from gabriel-smtp.zfn.uni-bremen.de (smtp.uni-bremen.de [134.102.50.15]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A9A23A0D03; Thu, 15 Jul 2021 05:33:26 -0700 (PDT) Received: from [192.168.217.118] (p548dcc89.dip0.t-ipconnect.de [84.141.204.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-smtp.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4GQYgm0Ss7z2xLb; Thu, 15 Jul 2021 14:33:24 +0200 (CEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) From: Carsten Bormann In-Reply-To: <25526.1626054262@localhost> Date: Thu, 15 Jul 2021 14:33:23 +0200 Cc: opsawg@ietf.org, iotops@ietf.org X-Mao-Original-Outgoing-Id: 648045203.664942-0d0b6350cd88a5bed5eef63ade0b8389 Content-Transfer-Encoding: quoted-printable Message-Id: <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> References: <25526.1626054262@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3608.120.23.2.7) Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 12:33:33 -0000 > My takeaway from all of this was that essentially... if = geofenced/CDNed DNS > is not gonna for for IoT devices with MUD files... then maybe the = advice > about working around them is WRONG. Maybe the right advice is... = DON'T DO THAT. >=20 > {ME: Doctor! Doctor! It hurts when I use a geographic CDN! > Doctor: Don't do that.} We want MUD files to be data origin authenticated and integrity = protected, possibly with a measure of freshness added. Relying on TLS communications security (server hostname authentication) = plus Web server integrity for that is possible as long as both the TLS = communications security and the delivery behavior of the authenticated = server are actually set up in a way that provides the above. (For my taste, this adds too many variables, and I would never rely on = TLS deployments to do this properly in the age of CDNs =E2=80=94 object = security is called for in cases where any real security is required.) Gr=C3=BC=C3=9Fe, Carsten From nobody Thu Jul 15 06:15:07 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D33753A1159; Thu, 15 Jul 2021 06:15:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.188 X-Spam-Level: X-Spam-Status: No, score=-4.188 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wq5TpVbCiqjH; Thu, 15 Jul 2021 06:15:00 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48BC73A1154; Thu, 15 Jul 2021 06:15:00 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 9D26238A89; Thu, 15 Jul 2021 09:17:58 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Kf-3h1vImFgG; Thu, 15 Jul 2021 09:17:53 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 06015389F5; Thu, 15 Jul 2021 09:17:53 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id AC368641; Thu, 15 Jul 2021 09:14:51 -0400 (EDT) From: Michael Richardson To: Erik Kline , iotops@ietf.org, madinas@ietf.org In-Reply-To: References: <2660.1626290680@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 13:15:06 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Erik Kline wrote: >> b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT >> devices, that they should always use the same MAC address for the >> same ESSID. >> > I suspect there's more to discuss or clarify here including, for exam= ple, > lifetime/session issues. Consider an owner/admin clicking the equiva= lent > of "forget this network" and reassociating to the same ESSID. I'd ex= pect a > new MAC could easily be justified by devices that do RCM for privacy > reasons. Sure, I agree that this is an edge case, and why the document will be 10 pages rather than one. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDwNMsACgkQgItw+93Q 3WWr8QgAkVeJb3m6n4a0FRTTNhox6GgpNN7R1Pem3Dm5Vkj4gVNeaYjrgOVkARIG UEB3n/kU5I61AeUwpY4TIRTK8RxUEFjZNfQZ+WqL+Gggnx+ngPjwvQlV8y2Dgqu+ xo0kN2WaOAcWNidGFKtiPtHxeBYc21wY1MJacBud4NR1AzQdjdl6kZAzY4UluDPS aZvw4BPLjFXJUPI/Us7ANs9ddxFYW5fGJ/sbDZNu5HoGqQVtdT+K7vdDqlF25Dt2 ca3LYfOFlhrqW+88iikntV66LfmdSfl9scMDPU0tIQEpJLLkAYGDuflPZHknClG/ 1MiZdfKIZ1eCeR8oKsdk1KnzUugSfw== =dCAf -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jul 15 07:42:20 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA5DB3A13CF; Thu, 15 Jul 2021 07:42:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kEo0WJ1cx9Oq; Thu, 15 Jul 2021 07:42:11 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86F9E3A13CB; Thu, 15 Jul 2021 07:42:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 09FBA38A94; Thu, 15 Jul 2021 10:45:11 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id bBuos1XxgCck; Thu, 15 Jul 2021 10:45:06 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id A6FFD38A8D; Thu, 15 Jul 2021 10:45:06 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 21C45641; Thu, 15 Jul 2021 10:42:05 -0400 (EDT) From: Michael Richardson To: Alan DeKok cc: iotops@ietf.org, madinas@ietf.org In-Reply-To: <04DE814C-BB42-4039-9172-826EBE5AE473@deployingradius.com> References: <2660.1626290680@localhost> <04DE814C-BB42-4039-9172-826EBE5AE473@deployingradius.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 14:42:18 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Alan DeKok wrote: > On Jul 14, 2021, at 3:24 PM, Michael Richardson wrote: >> I think that a BCP document on IoT devices, including routers, >> switches and other infrastructure would be good. > I agree. >> The short of it, for me, is that >> a) wired interfaces for non-movable things (home gateways, fridges, >> furnaces) should not change their MAC address. (Whether they use >> OUI derived addresses is a second question) >> >> b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT >> devices, that they should always use the same MAC address for the >> same ESSID. > It's probably fine to change it periodically. Right now, IIRC it's 24 > hours for most vendors. No, just Apple rotates on 24hr basis at this point. Others could start. The reason they do this has to do with the visibility of the MAC address, even when encrypted (see below). Others have said that they support the same MAC on the same ESSID. See the madinas slides from the BOF. >> Combining (a) and (b), I'm fine if wired devices that do 802.1x want= to do >> RCM. That would apply to many security paranoid enterprise >> desktops/laptops. But, I don't think that the IDS systems will be r= eady for >> a long time, as they mostly haven't caught up to IPv6 Temporary addr= esses yet. > If devices do 802.1X, then the authenticator can already identify the > device. The question then is which part of the network should be seen > as untrusted? If they are doing 802.1X, then the authenticator, when it authenticates the device, already knows how to tell the network about the policy for the MAC address (whether permanent or dujour). That's the point we need to get to for all devices that wish to do RCM. Networks that aren't using 802.1X do not necessarily have that mechanism. This means 95% of home networks. > If the device is roaming, then it makes sense to hide it's identity > from the visited network. It's also useful to hide the device identi= ty > on public WiFi frames. But once 802.1X is done, the link to the AP is > secure. And the device usually might as well use it's own, physical > MAC address. No, that's not true. The MAC address part of the frame is not encrypted by wifi, only the payloa= d. In many encryption modes, the MAC address is used as part of the input to t= he CTR, Nonce or IV (depending upon mode), such that two devices with the same (WEP) key don't produce packets that are identical when encrypted. =2D- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDwSTwACgkQgItw+93Q 3WU99gf/Zmqi7HllGcJrEpTdLuB5n7Ede0acwYNNCrVZADSl9uhvdQVxzrVxL0ed Hp6LhISXsvfzxX0MX+P0yrJ07yXwjuyEXGBGULuxAiM0ZZz2NYr4Rlbg40UF3sIS xkiNV+uZtfjS7SEIIBzhTQa6L5naL2c6SIuXk/78y8LKblS4j2czVzjJqSBSucAW 4e7zqgXwSERtqmpP1sUTTQXVWVVB2UE6CjfrdTWJGvo3SLMudeUDPJ7czdTjCndD P0hchA9aA2l7CPOWZzdH3Z99zNOdgE36ErdBGg219CtuX8foRW/A73Ee8ygSCxME IjrGWuzgaJU4y0fdzIZlwjLZOC/kEw== =rm2c -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jul 15 10:20:00 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D731E3A0FEF; Thu, 15 Jul 2021 10:19:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sigfox.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TwpEyT8I3Kgj; Thu, 15 Jul 2021 10:19:48 -0700 (PDT) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2111.outbound.protection.outlook.com [40.107.22.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 727F13A0FEA; Thu, 15 Jul 2021 10:19:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QzbQokcyYoBcMGezIlJFm/lSayayFDn5CfAJkA739VKO3Fj47hZH7Sjuf865rQCLcUYbAceBl7xIGLP2je8sizTNiCAzlrJQKAUpDa7H9lCvS5ri2O9RUGflV7KF+P0gn81WgGki1b9ESAwb4z+ipmHl7p10g7khG6aQjhqUuBRN31CA9W91oVaplZlCXjwbce2c+vaT7pkEm/70/jY4ZQ3+koJFgdBiUi3FG+EUl0ch7zh9Ff7kXMqFsxl3hpEoUis9R0WuDBuJs5Sf3KcRxGFhwkmleFzWO4Q67z8nVYBGHQRRtbRFoCylTPrnw/gLev1+hqwj0FZEOixMf/65xw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=j4iv8l+UoglHQ3din6a3rz0T67lYZvN8rCjVBJP9tDE=; b=OlQ5wEKdhL9xOMfcYvsJoIJNm2cq8P0zNV2SvWyMWW81ZSS82eGpRC/Lyu3jwTJLKFqVng41QCcR2WhsgZ54NwMSldfhmNTZl/UqAQzPzLFfBmF7kWFsk8KIwnXgng1JONRNfekxQMvbKRGBKLgqn66M5Atcd9y6FiAzOVBtDfzD9rsQiydUqhuZf7/4rM+jr2f1uaWTbPgy2hjg12hdzTgu0LlGdKU5MXChowMbpAalJqUvPNZVPAaTHfQt9CXmtoymwdb7IsnPPauaEBKiMBuNUUhqsFFx3RhBPmLzliDuMZJXyOo7Hxgay/UnAMEM+IRqROWt4WzZbCW1PJ5v4Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=sigfox.com; dmarc=pass action=none header.from=sigfox.com; dkim=pass header.d=sigfox.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigfox.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=j4iv8l+UoglHQ3din6a3rz0T67lYZvN8rCjVBJP9tDE=; b=TRyMWC6YpkfnvIwppLF05OQ2NQWg7gbVJ458QSdvYmG0pnGdnrq6A0IUkQ24JCnZva2p1vB5l4yXPz6wDqprM8yOHHENzCrcrc9Tr7pXL2aiUqgBnqAnI14AvUHJ40Ap47Liel3uGGIUFsLIkgZcKsY/PZqCyOXjjr737hYnV1c= Received: from DB7PR08MB3179.eurprd08.prod.outlook.com (2603:10a6:5:25::29) by DB6PR0801MB1623.eurprd08.prod.outlook.com (2603:10a6:4:3b::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.23; Thu, 15 Jul 2021 17:19:45 +0000 Received: from DB7PR08MB3179.eurprd08.prod.outlook.com ([fe80::f048:c6d1:955e:432d]) by DB7PR08MB3179.eurprd08.prod.outlook.com ([fe80::f048:c6d1:955e:432d%4]) with mapi id 15.20.4331.023; Thu, 15 Jul 2021 17:19:45 +0000 From: Juan Carlos Zuniga To: Tim Cappalli , "mcr+ietf@sandelman.ca" , "aland@deployingradius.com" CC: "madinas@ietf.org" , "iotops@ietf.org" Thread-Topic: [Madinas] advice on IoT MAC address randomization (or not) Thread-Index: AQHXeOYUoVYm936dgEykub/CVF3q7KtC+BaAgAElRoCAAClogIAAAjmQ Date: Thu, 15 Jul 2021 17:19:45 +0000 Message-ID: References: <2660.1626290680@localhost> <04DE814C-BB42-4039-9172-826EBE5AE473@deployingradius.com>, <16696.1626360125@localhost> In-Reply-To: Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2021-07-15T17:08:20.3048121Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=sigfox.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2563e7e0-8185-440b-5d9f-08d947b4bdcd x-ms-traffictypediagnostic: DB6PR0801MB1623: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: o8c8iSWnkSzb2TvfJ8JHDnMQXdZzBwXYI+h/E3mfP85WsINS6L4wCswP7FNNcbt0G7ZEefCV9yZDmi8u2YfLvSUd1UG1Jxmcb/gbF7b6mPWKa1GX5soZiY6OVYHPozwJ/9PJFysr7lYnmTY9gD15htcZUQwP0LxgfSJ+p0//YtGqpqZNoEkvR4HQTYrx/DlvexEvGiipBnRRxKJAz5QFaNrepsaQ6OU20ktdIH+rcHjrU39Q8HVVCWrjpCL/Q1A7jH8hKNg1LkhJjwQ8aHXfBerEn8tLNEWfkmhu3O2vKaJbR7dg3jSTX+tZ7WmUL9DgkmBzjmGvTH3hnoog9nll11WqH+s86VMO/0Smpcg/HbhbPzqhV0Er6LMNLfR/rbV9RqiY+Z8FlUGM9q9rFENduqHGVBri8bCwDdabsmS9FkSidijSwpPH2J+2kqM8xL6plFgj9jf3wC45MKL5G5tIc3ccTAtyzACBKX2Xs7dTFTj3fDr8UWaQc6xfqzFOSsasOORDLV0EDIQj/lMHCTfQ0o/8LUwKgfO7Pw1j26cDxspZVg1s/VMuMJgLx/b/UVosLp2tCPKfUqYSl50xMHLHefZ5Sscj/uSqxV9VYwegKPtSLUoAno4ueDJJmmdY7TbOdVMKXMr1ln79tsO/uK5pZPlKw3S0EMy6XCcX6eQuraDzR7oVHZNNnG8wS2WHMKm0bLYayeXVrZt4ywNCHcoKWpI9npFXlrbuUsljILuiuTtR7UX4Xn4elfVK7/vp1KK8xmndf40+T8Y1mx27MBKM3jB6nAEPmZaQ4AVLk0GE94c= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB7PR08MB3179.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(478600001)(6506007)(966005)(86362001)(45080400002)(64756008)(7696005)(53546011)(38100700002)(33656002)(2906002)(186003)(26005)(166002)(66946007)(316002)(55016002)(66574015)(5660300002)(54906003)(52536014)(66476007)(66446008)(66556008)(9686003)(110136005)(8936002)(4326008)(83380400001)(71200400001)(8676002)(76116006)(122000001)(38070700004); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?op1N2n8WP0cIOEFkZzbjXukxhqjyRa8xLv4rM+cCNRmIvvFPXaFz0amQht?= =?iso-8859-1?Q?1zp1+7UDv3W3kkcI7gHr93eyvXCLeIxONrFjFwk98gG0HhUy9Bq8Bk4NGS?= =?iso-8859-1?Q?6MGfEVysQQg8XTGtyuReQ0QwSP5p7/+DxZAoopUj5a/g1+rFEkdelCYQx9?= =?iso-8859-1?Q?JFzq6ALgmJ0C7tizdP3/Z1tEllIiRpe+GJKpryvzQx6BcbUvpB6+eyxe8M?= =?iso-8859-1?Q?8xKrte+DyugJ5Pfvk97VydMQEreqJxrGM2Vq/mlGKzP5PAxP9riu37id+L?= =?iso-8859-1?Q?MYsARKazgrayRgN2e4iQzMKoz4MEip1ubQcJir9Wwwt89af3Cq6o1PxusH?= =?iso-8859-1?Q?DxvlUi5NSBLJAc3PLe8Ulp/Qcj0hS6v98YUI1ba8w3Wp3RCSFRewUckSxh?= =?iso-8859-1?Q?T6pZs8mARMEAHcK3zEp5WNHKK17RpIhzxcyo9SQNFFV7trAYHRAiVnWb6U?= =?iso-8859-1?Q?I+nMG04G2zluiudzwRYlTp3lM762gSKQBHijhNdrMZ1uJi2TFeD5dc+9U7?= =?iso-8859-1?Q?XSG0hNduj9B3ecUzSfFAZBVEUfemcM3vSdRTR5V+K8O6h4lFja2pVdTBnA?= =?iso-8859-1?Q?YmSCD3vb9EocLZbK6oYBzMfFf+1L1sw9w6G1OY2br0vxj4rtMEn2umTU+i?= =?iso-8859-1?Q?4oF8wft0L64uFl3a9JgWDjCVg8dw5esv2ULpexS+3BeVGw66TPQi3OHB8G?= =?iso-8859-1?Q?l8lzcYmwxyseRkQhnjbqATPpvEwbncrsFNTdOpKayY+68vrTWPBX8Vnh5B?= =?iso-8859-1?Q?WNP3tAou9gF1vm6a2c/p9vAy8N9+aKPWcUB/9ySuwEhJkriKNxPewW81kb?= =?iso-8859-1?Q?HH0sUlzSiewxXEAu5gcflJxoh4nVcNkgc1KsU8l5GwWxdz+j/lqLbS7ypX?= =?iso-8859-1?Q?cjDgQan33OZ/zGfSLnoafsGB0FQCRi1KPJIPpIS5OVS4A/drE1omtsacS2?= =?iso-8859-1?Q?W4DEVHfuzq/psYKDLapBZk9XUsZp4M4HWAACF3w2Y2/AIM8l47nOjo8aO4?= =?iso-8859-1?Q?5d2sjuY54ZicppFkZ3E+HiigCxpQVz1TvgFtnlT9qnkRRTSl6kalTuG3EA?= =?iso-8859-1?Q?kW9FB8UwF7egF2lqFCYfJJvv/OKxfIfDw1ECswoiz8nH1Q8Lx/GkQRiuRP?= =?iso-8859-1?Q?QeMIMuQGjgN+kXkkMRUqPuhFM5pz5b+XmBoWRk3HMK6Fs47SlNugXsBqmZ?= =?iso-8859-1?Q?RfxODyt0EhhULDCxMDq3RYqyHWTVVUC9jYnWw5PDODg7eKEhrdEfEiwOsw?= =?iso-8859-1?Q?Y3xA6P8MWSbZpwSUSjoyqq8YKSaC0CU8ut95vuXUQBJSkm+dy2edLUVWnA?= =?iso-8859-1?Q?5Mx0gHcMdg6kLLwEoAkgx7LmBsjNLQG91xm67zKwgzXYR7XyRmq0LryJxV?= =?iso-8859-1?Q?/nTuwYGtRb?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DB7PR08MB3179CED888FAF954914267FD89129DB7PR08MB3179eurp_" MIME-Version: 1.0 X-OriginatorOrg: sigfox.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DB7PR08MB3179.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2563e7e0-8185-440b-5d9f-08d947b4bdcd X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2021 17:19:45.2984 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fcbc8bb1-061e-4b94-9f70-3ad917b0c8d3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 5ylfrfHm4WnOzQs4eWRdxZdCw7W3Fzqz0IixKTZ1/xn8Ol2XJ4fT8ukyvir1AMuThJcZu1ZP49tbSQsxAVGzaMg+ftRx7fpQlTILEw1wgSY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1623 Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 17:19:55 -0000 --_000_DB7PR08MB3179CED888FAF954914267FD89129DB7PR08MB3179eurp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable We have added some information about OS current practices in the latest ver= sion of: https://datatracker.ietf.org/doc/html/draft-zuniga-mac-address-randomizatio= n-01 Juan Carlos From: Madinas On Behalf Of Tim Cappalli Sent: July 15, 2021 1:10 PM To: mcr+ietf@sandelman.ca; aland@deployingradius.com Cc: madinas@ietf.org; iotops@ietf.org Subject: Re: [Madinas] advice on IoT MAC address randomization (or not) Just a clarification: Apple does not rotate MAC addresses every 24 hours (a= s of iOS 14 and macOS 12). They assign a MAC address on initlal connection = to an ESSID, the same as Google implemented in Android 10. Windows has the option for daily rotation, but it is an opt in feature. ________________________________ From: Michael Richardson > Sent: 2021-07-15 10:42 To: Alan DeKok = > Cc: madinas@ietf.org >; iotops@ietf.org > Subject: Re: [Madinas] advice on IoT MAC address randomization (or not) Alan DeKok > wr= ote: > On Jul 14, 2021, at 3:24 PM, Michael Richardson > wrote: >> I think that a BCP document on IoT devices, including routers, >> switches and other infrastructure would be good. > I agree. >> The short of it, for me, is that >> a) wired interfaces for non-movable things (home gateways, fridges, >> furnaces) should not change their MAC address. (Whether they use >> OUI derived addresses is a second question) >> >> b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT >> devices, that they should always use the same MAC address for the >> same ESSID. > It's probably fine to change it periodically. Right now, IIRC it's 2= 4 > hours for most vendors. No, just Apple rotates on 24hr basis at this point. Others could start. The reason they do this has to do with the visibility of the MAC address, even when encrypted (see below). Others have said that they support the same MAC on the same ESSID. See the madinas slides from the BOF. >> Combining (a) and (b), I'm fine if wired devices that do 802.1x want= to do >> RCM. That would apply to many security paranoid enterprise >> desktops/laptops. But, I don't think that the IDS systems will be r= eady for >> a long time, as they mostly haven't caught up to IPv6 Temporary addr= esses yet. > If devices do 802.1X, then the authenticator can already identify the > device. The question then is which part of the network should be see= n > as untrusted? If they are doing 802.1X, then the authenticator, when it authenticates the device, already knows how to tell the network about the policy for the MAC address (whether permanent or dujour). That's the point we need to get to for all devices that wish to do RCM. Networks that aren't using 802.1X do not necessarily have that mechanism. This means 95% of home networks. > If the device is roaming, then it makes sense to hide it's identity > from the visited network. It's also useful to hide the device identi= ty > on public WiFi frames. But once 802.1X is done, the link to the AP i= s > secure. And the device usually might as well use it's own, physical > MAC address. No, that's not true. The MAC address part of the frame is not encrypted by wifi, only the payloa= d. In many encryption modes, the MAC address is used as part of the input to t= he CTR, Nonce or IV (depending upon mode), such that two devices with the same (WEP) key don't produce packets that are identical when encrypted. -- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca https://nam06.safelinks.pr= otection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.sandelman.ca%2F&data=3D04%= 7C01%7Ctim.cappalli%40microsoft.com%7C88a1636683ac467bbe6c08d9479ec449%7C72= f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637619569525845289%7CUnknown%7CTWF= pbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D= %7C1000&sdata=3DApBsRqrPLeOiPK38EfXrt%2BJK2A7TWzkhZfD734Mv3uo%3D&re= served=3D0 | ruby on rails [ -- Michael Richardson > = . o O ( IPv6 I=F8T consulting ) Sandelman Software Works Inc, Ottawa and Worldwide --_000_DB7PR08MB3179CED888FAF954914267FD89129DB7PR08MB3179eurp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

We have a= dded some information about OS current practices in the latest version of:<= o:p>

&nbs= p;

https://datatracker.ietf.org/doc/html/draft-zuniga-mac-address-ra= ndomization-01

&nbs= p;

Juan Carl= os

&nbs= p;

From: Madinas <madinas-bounces@ietf.org> On Behalf Of Tim Cappalli
Sent: July 15, 2021 1:10 PM
To: mcr+ietf@sandelman.ca; aland@deployingradius.com
Cc: madinas@ietf.org; iotops@ietf.org
Subject: Re: [Madinas] advice on IoT MAC address randomization (or n= ot)

 

Just a clarification: Apple does not rota= te MAC addresses every 24 hours (as of iOS 14 and macOS 12). They assign a = MAC address on initlal connection to an ESSID, the same as Google implemented in Android 10.

 

Windows has the option for daily rotation= , but it is an opt in feature.

 

From: Michael Richardson <mcr+ietf@sandelman.ca>
Sent: 2021-07-15 10:42
To: Alan DeKok <aland@deplo= yingradius.com>
Cc: madinas@ietf.org <madinas@ietf.org>; iotops@ietf.org <iotops@ietf.org>
Subject: Re: [Madinas] advice on IoT MAC address randomization (or not)

 


Alan DeKok <aland@deploying= radius.com> wrote:
    > On Jul 14, 2021, at 3:24 PM, Michael Richardson <= ;mcr+ietf@sandelman.ca> wro= te:
    >> I think that a BCP document on IoT devices, inc= luding routers,
    >> switches and other infrastructure would be good= .

    > I agree.

    >> The short of it, for me, is that
    >> a) wired interfaces for non-movable things (hom= e gateways, fridges,
    >> furnaces) should not change their MAC address.&= nbsp; (Whether they use
    >> OUI derived addresses is a second question)
    >>
    >> b) Until WPA-Enterprise aka EAP-TLS,.. is ubiqu= itous among wifi IoT
    >> devices, that they should always use the same M= AC address for the
    >> same ESSID.

    > It's probably fine to change it periodically. = Right now, IIRC it's 24
    > hours for most vendors.

No, just Apple rotates on 24hr basis at this point.  Others could star= t.
The reason they do this has to do with the visibility of the MAC address, even when encrypted (see below).

Others have said that they support the same MAC on the same ESSID.
See the madinas slides from the BOF.

    >> Combining (a) and (b), I'm fine if wired device= s that do 802.1x want to do
    >> RCM.  That would apply to many security pa= ranoid enterprise
    >> desktops/laptops.  But, I don't think that= the IDS systems will be ready for
    >> a long time, as they mostly haven't caught up t= o IPv6 Temporary addresses yet.

    > If devices do 802.1X, then the authenticator can al= ready identify the
    > device.  The question then is which part of th= e network should be seen
    > as untrusted?

If they are doing 802.1X, then the authenticator, when it authenticates the=
device, already knows how to tell the network about the policy for the MAC<= br> address (whether permanent or dujour).
That's the point we need to get to for all devices that wish to do RCM.
Networks that aren't using 802.1X do not necessarily have that mechanism. This means 95% of home networks.

    > If the device is roaming, then it makes sense to hi= de it's identity
    > from the visited network.  It's also useful to= hide the device identity
    > on public WiFi frames.  But once 802.1X is don= e, the link to the AP is
    > secure.  And the device usually might as well = use it's own, physical
    > MAC address.

No, that's not true.

The MAC address part of the frame is not encrypted by wifi, only the payloa= d.
In many encryption modes, the MAC address is used as part of the input to t= he
CTR, Nonce or IV (depending upon mode), such that two devices with the same=
(WEP) key don't produce packets that are identical when encrypted.

--
]            &n= bsp;  Never tell me the odds!       = ;          | ipv6 mesh network= s [
]   Michael Richardson, Sandelman Software Works   = ;     |    IoT architect   [ ]     mcr@sandelman= .ca  https://nam06.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.sand= elman.ca%2F&amp;data=3D04%7C01%7Ctim.cappalli%40microsoft.com%7C88a1636= 683ac467bbe6c08d9479ec449%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C6376= 19569525845289%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIi= LCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DApBsRqrPLeOiPK38EfXrt= %2BJK2A7TWzkhZfD734Mv3uo%3D&amp;reserved=3D0    = ;    |   ruby on rails    [




--
Michael Richardson <mcr+IETF@sa= ndelman.ca>   . o O ( IPv6 I=F8T consulting )
           Sandelman Soft= ware Works Inc, Ottawa and Worldwide



--_000_DB7PR08MB3179CED888FAF954914267FD89129DB7PR08MB3179eurp_-- From nobody Thu Jul 15 11:02:19 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A0E03A1695; Thu, 15 Jul 2021 11:02:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KUqGA-j70Tca; Thu, 15 Jul 2021 11:02:09 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 185FA3A1684; Thu, 15 Jul 2021 11:02:08 -0700 (PDT) Received: from [192.168.46.129] (24-52-251-6.cable.teksavvy.com [24.52.251.6]) by mail.networkradius.com (Postfix) with ESMTPSA id 82804FF; Thu, 15 Jul 2021 18:02:06 +0000 (UTC) Authentication-Results: NetworkRADIUS; dmarc=none (p=none dis=none) header.from=deployingradius.com Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) From: Alan DeKok In-Reply-To: <16696.1626360125@localhost> Date: Thu, 15 Jul 2021 14:02:04 -0400 Cc: iotops@ietf.org, madinas@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <2660.1626290680@localhost> <04DE814C-BB42-4039-9172-826EBE5AE473@deployingradius.com> <16696.1626360125@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3608.120.23.2.7) Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 18:02:15 -0000 On Jul 15, 2021, at 10:42 AM, Michael Richardson = wrote: > Alan DeKok wrote: > No, just Apple rotates on 24hr basis at this point. Others could = start. > The reason they do this has to do with the visibility of the MAC = address, > even when encrypted (see below). Ah, OK. > If they are doing 802.1X, then the authenticator, when it = authenticates the > device, already knows how to tell the network about the policy for the = MAC > address (whether permanent or dujour). I was wondering if there was a difference between a device connected = directly to a home network, and one connected via a visited network. It = looks like not. If the MAC is publicly visible, then we can just assume that the = network is always untrusted. Alan DeKok. From nobody Thu Jul 15 11:11:53 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 314693A177C; Thu, 15 Jul 2021 11:11:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SpDUNgZUP6pb; Thu, 15 Jul 2021 11:11:42 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E5673A1777; Thu, 15 Jul 2021 11:11:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 3E86938A94; Thu, 15 Jul 2021 14:14:43 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id oCpLDPCdJ1Vf; Thu, 15 Jul 2021 14:14:40 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id DB90938A89; Thu, 15 Jul 2021 14:14:39 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id C8169641; Thu, 15 Jul 2021 14:11:37 -0400 (EDT) From: Michael Richardson To: Robert Kisteleki , opsawg@ietf.org, iotops@ietf.org In-Reply-To: References: <25526.1626054262@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 18:11:47 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Robert Kisteleki wrote: >> but also that the IoT device should also be careful to observe >> caching semantics, particularly in the case of a connection failure. > Doesn't that prescribe that the IoT devices "should behave correctly"? > Because we all know in reality they do not, at least not always -- bu= t then > what is a MUD controller supposed to do? Work around? Cover potential= bad > cases? Ignore this? It's a BCP, and even if it was a STD, it would still be a voluntary standar= d. When the vendor does something dumb, the RFC/BCP at least lets customers and ISPs tell the vendor who has problems (or has caused problems), that th= ey have violated the BCP. "Get a clue" our advice had better: 1) actually do something useful 2) be implementable =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDwelkACgkQgItw+93Q 3WWf+QgAo5oKotTU/OzjClMV4iON7SfQzvhbeD8X9CuSSvQd9cfZraUVw3hankvi 4WP3Yb+qCh9oXeV01p6hH2+lrcSoscUCsNF36rMlLebHCZC3LkSEQNz26RqCp+gd J7RujQ5DLHTOP+KG460M4fN+eq5noT+zWc7Nq/1eHlocYcxy65+/e6+LrYlJrpuU 64mxLmJ7chXtFev0NRnFqZkBI40M7snHQJPIBX+BTFkzGI7fkkCYbGSAyHeh/Z77 xhe/4/cIZuk+1qRDCCEKRNQ7/YGqDSOjAt0pOWW1leazH5+5xwgIQnswm2LZAnGl qzmS5WTW6TI5qdiQEW59Pqbg9KYMxA== =dzoO -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jul 15 11:17:08 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82D4F3A1817; Thu, 15 Jul 2021 11:17:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9aKs6P7Q8zbH; Thu, 15 Jul 2021 11:17:01 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97EB13A1814; Thu, 15 Jul 2021 11:17:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 4F37138A94; Thu, 15 Jul 2021 14:20:02 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id xwCxHjoAdn-r; Thu, 15 Jul 2021 14:19:58 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 725DB38A89; Thu, 15 Jul 2021 14:19:58 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 5AD5A641; Thu, 15 Jul 2021 14:16:56 -0400 (EDT) From: Michael Richardson To: Carsten Bormann , opsawg@ietf.org, iotops@ietf.org In-Reply-To: <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> References: <25526.1626054262@localhost> <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 18:17:07 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Carsten Bormann wrote: >> My takeaway from all of this was that essentially... if geofenced/CD= Ned DNS >> is not gonna for for IoT devices with MUD files... then maybe the ad= vice >> about working around them is WRONG. Maybe the right advice is... DO= N'T DO THAT. >> >> {ME: Doctor! Doctor! It hurts when I use a geographic CDN! >> Doctor: Don't do that.} > We want MUD files to be data origin authenticated and integrity > protected, possibly with a measure of freshness added. Hi, we aren't talking about MUD controllers retrieving MUD files. MUD files can be (and are) signed. (with CMS. Ick) I'm not entirely sure if you have confused things here. The connections this document deals with are those initiated by the IoT devices, towards some Internet target, in order to effect their function. As an example of a TCP connection that would be hard to describe, the TCP chunks used in a video feed such as netflix uses, would be an example. They are to random EC2 hosts, at whichever IP addresses EC2 happen to assign. (I assume that Prime, Disney, Britbox, Crunchyroll also do this, but I haven't read any analysis of that yet. Smaller, more specialized services, might get away with a small set of permanent servers. I know that youtube does not do this, but rather connects to Google's nearest dark-fiber gatewa= y) A MUD definition for a SmartTV that had Netflix on it might have to acceptlist the entire EC2 blocks, which are like /12s or something like tha= t. That's a lot of access, and leaves all of EC2 attackable by IoT devices. (Again, IPv6 would make this problem mostly go away) =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDwe5gACgkQgItw+93Q 3WV0LAf/X57ah0xgWJKPCGskBt/2o4f6IueNnFYg40T0ZxV83TNR++lj2Af3tk86 CYqWw1gXUmwOFU+juzp2dbu04F+I2SYeYJ+qER9LcjUyjin1LmzMO+vNZykJqvCp taRpV4KJJtEPkz5/OEQurDNr+tgYbm/NtqZIUgoNTmNt3AFYWFe5VeLzsDcAE0Wn YCxpNdNpL8NP1Tu5WQxCOgpxGfXylYhFEFU3zCUMEbXOJokTMJZMZbcN7WpuepBY m8u+IZ6SlSD3ITtrOjjoU7k24kzLBjzZaaI0ovnEoDx8iiXyp8riqiZLUmcg/+Oo qarMxTeyacyGYkd47dppsPXOolt4Rw== =szLD -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jul 15 11:39:58 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CFFC3A0C98; Thu, 15 Jul 2021 11:39:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gbFlTvh7Ee7N; Thu, 15 Jul 2021 11:39:48 -0700 (PDT) Received: from gabriel-smtp.zfn.uni-bremen.de (smtp.zfn.uni-bremen.de [134.102.50.15]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 048323A0C83; Thu, 15 Jul 2021 11:39:47 -0700 (PDT) Received: from smtpclient.apple (p548dcc89.dip0.t-ipconnect.de [84.141.204.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-smtp.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4GQjpT1xXNz2xKG; Thu, 15 Jul 2021 20:39:45 +0200 (CEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.100.0.2.22\)) From: Carsten Bormann In-Reply-To: <8763.1626373016@localhost> Date: Thu, 15 Jul 2021 20:39:44 +0200 Cc: opsawg@ietf.org, iotops@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <25526.1626054262@localhost> <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> <8763.1626373016@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3654.100.0.2.22) Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 18:39:54 -0000 On 15. Jul 2021, at 20:16, Michael Richardson = wrote: >=20 > As an example of a TCP connection that would be hard to describe, Ah, right, we are using IP addresses as credentials (in the =E2=80=9CACLs=E2= =80=9D inside MUD). > That's a lot of access, and leaves all of EC2 attackable by IoT = devices. And, more importantly, leaves IoT devices attackable by all of EC2. This is just a symptom of the fact that we don=E2=80=99t have ways to = properly model desirable communication, in a way that the desirability = then is verifiable by justified parties. So let=E2=80=99s work on those. Gr=C3=BC=C3=9Fe, Carsten PS.: you can put in your paper submissions at = https://dai-snac21.hotcrp.com/; deadline September 17 From nobody Thu Jul 15 11:46:18 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E89123A0DF8; Thu, 15 Jul 2021 11:46:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.118 X-Spam-Level: X-Spam-Status: No, score=-1.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dzCyAz4Yyk5C; Thu, 15 Jul 2021 11:46:11 -0700 (PDT) Received: from faui40.informatik.uni-erlangen.de (faui40.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E2CA3A0DF7; Thu, 15 Jul 2021 11:46:11 -0700 (PDT) Received: from faui48e.informatik.uni-erlangen.de (faui48e.informatik.uni-erlangen.de [131.188.34.51]) by faui40.informatik.uni-erlangen.de (Postfix) with ESMTP id DDFB5548015; Thu, 15 Jul 2021 20:46:04 +0200 (CEST) Received: by faui48e.informatik.uni-erlangen.de (Postfix, from userid 10463) id D68554E7A57; Thu, 15 Jul 2021 20:46:04 +0200 (CEST) Date: Thu, 15 Jul 2021 20:46:04 +0200 From: Toerless Eckert To: Carsten Bormann Cc: Michael Richardson , opsawg@ietf.org, iotops@ietf.org Message-ID: <20210715184604.GF24216@faui48e.informatik.uni-erlangen.de> References: <25526.1626054262@localhost> <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> <8763.1626373016@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 18:46:17 -0000 Reminds me of the concern about authentication of addressing i just brought up on another mailing list to you ;-) On Thu, Jul 15, 2021 at 08:39:44PM +0200, Carsten Bormann wrote: > On 15. Jul 2021, at 20:16, Michael Richardson wrote: > > > > As an example of a TCP connection that would be hard to describe, > > Ah, right, we are using IP addresses as credentials (in the “ACLs” inside MUD). > > > That's a lot of access, and leaves all of EC2 attackable by IoT devices. > > And, more importantly, leaves IoT devices attackable by all of EC2. > > This is just a symptom of the fact that we don’t have ways to properly model desirable communication, in a way that the desirability then is verifiable by justified parties. > So let’s work on those. > > Grüße, Carsten > > PS.: you can put in your paper submissions at https://dai-snac21.hotcrp.com/; deadline September 17 > > > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg -- --- tte@cs.fau.de From nobody Thu Jul 15 12:41:45 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B5EB3A0B0A; Thu, 15 Jul 2021 12:41:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VDSDrRWlj6JJ; Thu, 15 Jul 2021 12:41:33 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42A323A0B44; Thu, 15 Jul 2021 12:41:32 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 7821E38A98; Thu, 15 Jul 2021 15:44:32 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id cYsrXF2OG66n; Thu, 15 Jul 2021 15:44:28 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 0D9B538A95; Thu, 15 Jul 2021 15:44:28 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id B703A319; Thu, 15 Jul 2021 15:41:25 -0400 (EDT) From: Michael Richardson To: Carsten Bormann , opsawg@ietf.org, iotops@ietf.org In-Reply-To: References: <25526.1626054262@localhost> <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> <8763.1626373016@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 19:41:38 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Carsten Bormann wrote: >> As an example of a TCP connection that would be hard to describe, > Ah, right, we are using IP addresses as credentials (in the =E2=80=9C= ACLs=E2=80=9D inside MUD). >> That's a lot of access, and leaves all of EC2 attackable by IoT devi= ces. > And, more importantly, leaves IoT devices attackable by all of EC2. Maybe. Depends upon implementation and details. For UDP, probably, assuming IoT device was addressable. But, mostly TCP SYN flow is unidirectional in the ACLs. > This is just a symptom of the fact that we don=E2=80=99t have ways to= properly > model desirable communication, in a way that the desirability then is > verifiable by justified parties. > So let=E2=80=99s work on those. Well, in the EC2 case, the right solution would seem to be to assign IPv6 blocks to larger user. But, in general you are right. How, does an authoritative (or even authoritarian) firewall identify itself such that traffic that needs to traverse it can self-identify? APN has this problem. I described this problem back in 1996: https://www.ietf.org/archive/id/draft-richardson-ipsec-aft-00.txt https://www.ietf.org/archive/id/draft-richardson-ipsec-traversal-01.txt > PS.: you can put in your paper submissions at > https://dai-snac21.hotcrp.com/; deadline September 17 Interesting. I guess you are suggesting that the problem I've described is= a general problem, and is worth a paper. I'll think about it. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDwj2UACgkQgItw+93Q 3WXULwf9EgrKQXLOb5J3uS2WWwCVDCr3Y5K4dXrC/8vFj/x7+2WPVQ2xPaDOXalB YKS6v7aWntKFVc8HBdmu1ui4bGSzuym1g4dvXhMFq40YZ9sN6KQHR2Ld0dECHLwR G0z3VPjarR9U+2EZqVbz2Y2j8uNqUjCDjXYR7nfkLFAJSOjki45DPFfah+7vGPm+ X9U3sF4TMagtr8Wn37gmZt06GtEEreWuNYM1mcZrXNOzVTnSSPf2VY7gid07xQ4L sU+ouDm15FJCgKb9klc+h3UP9DZbQEBjjfrrhp8YBEL41yTNmIRo9j5oOfkFIcjU 4iAa7VJ+SqwOnb2zBeVuBg3wATJv/Q== =p+Nu -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jul 15 13:15:58 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D76E3A0DDE; Thu, 15 Jul 2021 10:10:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.552 X-Spam-Level: X-Spam-Status: No, score=-2.552 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.452, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qSkK97aM4QMo; Thu, 15 Jul 2021 10:10:21 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640107.outbound.protection.outlook.com [40.107.64.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92F593A0DE2; Thu, 15 Jul 2021 10:10:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qxyip0ZwRweNyjrzFhuTlbjpGn4MrxDIW+1Jk2ZzhHmk+QI7kllPgxqQ/emVOS44rTUoQN3A3FyDfesIFRLeVDYgIsrG2mTAaV66hN2Joz43JSIxAQN2BqS5J7VAbinR3QLiLMO22DLzhODe09i4F/7VTw1vnXgYU38DTAoBbwhr6rPsk2bI3UQH/aZQYDZEG4A2zOoNYleOhZAmEQotQgDgVFKWJtoZWbCbVM/MBNZpOIkGLHN6Lf6xXPq5rh3v3I+xgCeGcT4QM0kRKmum4dslE7EfdTXcwODGP627U9Hwbt/5k8hVN75AoTTvrYK8g3h0cDrgQdcvKgdy9csUTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gXtOH7v3+9tolSCXRGFuTZTofepX0W2z9ACFtWQH/tE=; b=T3xZ4iLi4mySg3EdfmMQ+42rb2dCXDUqEFobcgK2MG3sU//uo/cCTz860Lxv05iPjaKUYd8MBxCxuYxJhzBAihumzwQU4v04stZl5TYEncfia7euWE7Um0SwBkscWWyZN5rQSQuCj36rhbzTiv0jTwW3D7od5nKDy+qQUmN0A7NONxaHhQhKd+kvyBCva6PDGgOKPFcq+o+bTcxhojmRHBFtws93p0zDVRLVYbJiC27Uc2HBkE9y0ieCe3gqyeyurcwoiVIsVuNrhKD19BVwg0JUMiWPE1Y/G850xTYCPzJUQugzfp4ctlz586c4QzI99MnDoWptW1RmxexMYHtIsA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gXtOH7v3+9tolSCXRGFuTZTofepX0W2z9ACFtWQH/tE=; b=PwtLBdpQ7goHap7yi8Rtil37+cnAEcKtCfR2hP4p9F43+uWnQnZrbKpl+SZko3A0CfcCp/vd1ZX7ggChpq4kEj9ciFGOBp6sDoHQ5EWclGqwQibyOH0oGfbwHnnPzhWWxp4fU37CG+T1rnPmYb2r7NpeMBnXqNz72mdhYfTpB48= Received: from PH0PR00MB1029.namprd00.prod.outlook.com (2603:10b6:510:48::6) by PH0PR00MB1213.namprd00.prod.outlook.com (2603:10b6:510:9d::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4368.0; Thu, 15 Jul 2021 17:10:17 +0000 Received: from PH0PR00MB1029.namprd00.prod.outlook.com ([fe80::38f6:21ff:aca7:8755]) by PH0PR00MB1029.namprd00.prod.outlook.com ([fe80::38f6:21ff:aca7:8755%4]) with mapi id 15.20.4370.000; Thu, 15 Jul 2021 17:10:17 +0000 From: Tim Cappalli To: "mcr+ietf@sandelman.ca" , "aland@deployingradius.com" CC: "madinas@ietf.org" , "iotops@ietf.org" Thread-Topic: [Madinas] advice on IoT MAC address randomization (or not) Thread-Index: AQHXeOXzxvYotgSHS0C58QFiMnTg96tC+BeAgAElRoCAACjdpA== Date: Thu, 15 Jul 2021 17:10:17 +0000 Message-ID: References: <2660.1626290680@localhost> <04DE814C-BB42-4039-9172-826EBE5AE473@deployingradius.com>, <16696.1626360125@localhost> In-Reply-To: <16696.1626360125@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2021-07-15T17:08:20.3048121Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=microsoft.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1b7dcea3-88a7-4467-9fe6-08d947b36b89 x-ms-traffictypediagnostic: PH0PR00MB1213: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: On751rota8zNlrGJxjFcb4EXvw8VeQGfghCc4NKUWngqW+QpHjSIKLSgCB1XV0l0zuyE+NjlphHnzVnhAHtEQucxIYGuB+XNz4nTsWFyjbX59PzuwKNAvdSFBCu3RV3x4NFN6S3jPV4ex3T34BbUSNNIY7Ay4fI80pN1tbpcnOt+aIeq5c6o5ny/CdeymgLHZROnxxdA7CTMPlBFJus7pFiOWZC7e3zsrI5wiB/EdlKLQT/a5jw7jb92VBo2pBE4drxWL/Z5U3bYPQ/HWvWfhM8PHDfQBlJUn3ikx9xPiGj/R0Z2YHYpQsEwGe8Ec0IKID4OPAN4v+kVMsrR/BiZtv0wuPy89kft3svmFnPTGhZ9xoK3i6hizPKsKyN0jucNhWMiIeQyEEb8xYgXYRbhiPwYm4rV8qKuAhRgbk3K5WLvJYebUsEkDHeDz8axE97067mq2qbVfkBq0nbvVatAVF0xYap6IK4zDmbzX9Fq1JD7HyPL2m1yRhWjMJljOPhUncKRaKSmUFGaGrEdwqDDobHZzCK4n4dX03XfuC3b4XmJSJz6/7r3w5knZAV2AYzppcIzFUuELyyQGcMz0JZOUnawF2d8tbxowALbydWdtaVKlQ9L1kcxEguTLjrpovfc+dvIdWKK101ys65x3IGbPEFY/anDmNS/nLSN1wWkkaxvCZr1hXD55HcAFnOoJ4Jx++vVhUPIeLlebTBc/m6JNUi/BpiPi17pXnXJ+HG1liEFbyEdvm+bAE08vrseD//ry3BrFfWFpdeL5WyeA2CSlnex6PG86Jm6TcrnizBn5BI= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH0PR00MB1029.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(66574015)(83380400001)(19627405001)(316002)(122000001)(38100700002)(166002)(9686003)(186003)(26005)(966005)(478600001)(66446008)(4326008)(64756008)(110136005)(55016002)(66556008)(54906003)(33656002)(7696005)(8936002)(86362001)(5660300002)(91956017)(82960400001)(2906002)(71200400001)(52536014)(8990500004)(66476007)(8676002)(6506007)(82950400001)(53546011)(10290500003)(76116006)(66946007)(38070700004); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?WW03jzTJnFrorBxFK81OgSZuZzRMreL8XOjdM5eog7wv1GNlOSjIpbMDKE?= =?iso-8859-1?Q?uvPYeKhg03slvA5RHJukl6q27s8Dx4QCBHrbKCU4pHlkhnL1+HpRTiqrFF?= =?iso-8859-1?Q?vSHSxAbBRx8TvLH7XXTKnofZ7eWfpXuQWWZ2J5UIsYSMOZz3vWs3equR3N?= =?iso-8859-1?Q?E49Tmd155rmxOapg+P10ohJ6TTXzsVvCyASCPo0WFOGpsHYmh6VlE0qVaT?= =?iso-8859-1?Q?lg6DaLUfOycAhq7O3xXcU6gCQXKz86V4ukNtLGbbDRrlTYes2NBUILFh6D?= =?iso-8859-1?Q?rHT0uOt/8gMNOY1Z12pf5x0VL2pGQ3MckD/bmh2WLTH14JPE5cn5lWFJYW?= =?iso-8859-1?Q?kVy0YD+7XultDtA0z0fo2YLVdnMrVVqZ+syS90MPT/b6zagpidglgH/KGj?= =?iso-8859-1?Q?G1XkKEKsGxQs3gkwfz4AbBVQsuDkWSuuj6h++LZz2d/yO8vF+YwBi773Zu?= =?iso-8859-1?Q?de8LzErIK94jkbHoC3mQPlZoJGAznM4VGeOf4XXrooD23oe91s5cE3kxAH?= =?iso-8859-1?Q?q/I79kIuUbCXzJzhYXHCTIGZ/HiAZ/VQv7DOS76Ktj6OVV3H6IFKGZbeqX?= =?iso-8859-1?Q?wJ0MTNtjtolJJEqHNBs6Upn+E0X8UBbLxWsMwf11T11/RXs1uSP89a65zc?= =?iso-8859-1?Q?X15/oAI7Zt5Hx50pg/diZBnuZ2Mp/3UghGxGd/TQgqZhhwsvunSeFHwDtW?= =?iso-8859-1?Q?R8t90cj1lCogM8S+fHZ4tQL3mY6lx60TmV/YTLCk9JOlmEI4j93oipTgEl?= =?iso-8859-1?Q?xax2PXpZpHxXgIovD20IHR8f49TdsRaIvstFAQaevtt/ohM70ae1+8lNpX?= =?iso-8859-1?Q?jjB9UMViM9PgQA1LtOj6ySACJw27M2HieAyy/zLc/cwNFQL455GVGn+hV9?= =?iso-8859-1?Q?OwHYqwsrjGFzI9AaOpom6/E5u9tMlyQVAbKb2hj72XPXHpUt0RKU/StypP?= =?iso-8859-1?Q?sBLwx1iO2cynbEAZY++5/owKtBa8m3hKJQnIwf+k6TbuQUjA/lUCmIs6PR?= =?iso-8859-1?Q?qv21hLxP6IQRjEyBNtDO5xd6mwJ62LSu42ZM1XUYaFKk5/vY1C68alsUgH?= =?iso-8859-1?Q?bqa27LxM9AZMVQmF5B05IVY4j0w4NMnkguEyNzM/Kk3QTsPS/lhaU0/dNy?= =?iso-8859-1?Q?0k7ac0dgP5DWT9A1XyTxTj1NP92Vtd9s6FcgbxF+QO502j4UdrXYkhtuFq?= =?iso-8859-1?Q?1QU/rrb4Pc6Msv/wHkh+1kIZvgLxUGB/hXh13YfMWGEt95UNW5cbtGqGWG?= =?iso-8859-1?Q?WF5aCRhXkG5KUbeeGbaLqZ37PYctDN39GWSBoABDeRQ/7UbaXiJqJiW8Q3?= =?iso-8859-1?Q?fT1cCjimjuVTdnArC5AJ38bEkA=3D=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_PH0PR00MB102997FB0CA238A23D222BC495129PH0PR00MB1029namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR00MB1029.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1b7dcea3-88a7-4467-9fe6-08d947b36b89 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2021 17:10:17.7649 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: L8NJgeRKdxfjQ1q+8V+uuUj6KH4B5KQBRZql+aEVBuJZLCtC971Wx+4fxFoSmqPdZ+6FL6yz6GeotxhWcLK0VQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR00MB1213 Archived-At: X-Mailman-Approved-At: Thu, 15 Jul 2021 13:15:56 -0700 Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 17:10:27 -0000 --_000_PH0PR00MB102997FB0CA238A23D222BC495129PH0PR00MB1029namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Just a clarification: Apple does not rotate MAC addresses every 24 hours (a= s of iOS 14 and macOS 12). They assign a MAC address on initlal connection = to an ESSID, the same as Google implemented in Android 10. Windows has the option for daily rotation, but it is an opt in feature. ________________________________ From: Michael Richardson Sent: 2021-07-15 10:42 To: Alan DeKok Cc: madinas@ietf.org ; iotops@ietf.org Subject: Re: [Madinas] advice on IoT MAC address randomization (or not) Alan DeKok wrote: > On Jul 14, 2021, at 3:24 PM, Michael Richardson wrote: >> I think that a BCP document on IoT devices, including routers, >> switches and other infrastructure would be good. > I agree. >> The short of it, for me, is that >> a) wired interfaces for non-movable things (home gateways, fridges, >> furnaces) should not change their MAC address. (Whether they use >> OUI derived addresses is a second question) >> >> b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT >> devices, that they should always use the same MAC address for the >> same ESSID. > It's probably fine to change it periodically. Right now, IIRC it's 2= 4 > hours for most vendors. No, just Apple rotates on 24hr basis at this point. Others could start. The reason they do this has to do with the visibility of the MAC address, even when encrypted (see below). Others have said that they support the same MAC on the same ESSID. See the madinas slides from the BOF. >> Combining (a) and (b), I'm fine if wired devices that do 802.1x want= to do >> RCM. That would apply to many security paranoid enterprise >> desktops/laptops. But, I don't think that the IDS systems will be r= eady for >> a long time, as they mostly haven't caught up to IPv6 Temporary addr= esses yet. > If devices do 802.1X, then the authenticator can already identify the > device. The question then is which part of the network should be see= n > as untrusted? If they are doing 802.1X, then the authenticator, when it authenticates the device, already knows how to tell the network about the policy for the MAC address (whether permanent or dujour). That's the point we need to get to for all devices that wish to do RCM. Networks that aren't using 802.1X do not necessarily have that mechanism. This means 95% of home networks. > If the device is roaming, then it makes sense to hide it's identity > from the visited network. It's also useful to hide the device identi= ty > on public WiFi frames. But once 802.1X is done, the link to the AP i= s > secure. And the device usually might as well use it's own, physical > MAC address. No, that's not true. The MAC address part of the frame is not encrypted by wifi, only the payloa= d. In many encryption modes, the MAC address is used as part of the input to t= he CTR, Nonce or IV (depending upon mode), such that two devices with the same (WEP) key don't produce packets that are identical when encrypted. -- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca https://nam06.safelinks.protection.outlook.com/?url= =3Dhttp%3A%2F%2Fwww.sandelman.ca%2F&data=3D04%7C01%7Ctim.cappalli%40mic= rosoft.com%7C88a1636683ac467bbe6c08d9479ec449%7C72f988bf86f141af91ab2d7cd01= 1db47%7C1%7C0%7C637619569525845289%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw= MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=3DApBsR= qrPLeOiPK38EfXrt%2BJK2A7TWzkhZfD734Mv3uo%3D&reserved=3D0 | rub= y on rails [ -- Michael Richardson . o O ( IPv6 I=F8T consulting = ) Sandelman Software Works Inc, Ottawa and Worldwide --_000_PH0PR00MB102997FB0CA238A23D222BC495129PH0PR00MB1029namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Just a clarification: Apple does not rotate MAC addresses every 24 hours (a= s of iOS 14 and macOS 12). They assign a MAC address on initlal connection = to an ESSID, the same as Google implemented in Android 10.

Windows has the option for daily rotation, but it is an opt in feature.

From: Michael Richardson <mcr+ietf@sandelman.ca> Sent: 2021-07-15 10:42
To: Alan DeKok <aland@deployingradius.com>
Cc: madinas@ietf.org <madinas@ietf.org>; iotops@ietf.org <io= tops@ietf.org>
Subject: Re: [Madinas] advice on IoT MAC address randomization (or no= t)
 

Alan DeKok <aland@deployingradius.com> wrote:
    > On Jul 14, 2021, at 3:24 PM, Michael Richardson <= ;mcr+ietf@sandelman.ca> wrote:
    >> I think that a BCP document on IoT devices, inc= luding routers,
    >> switches and other infrastructure would be good= .

    > I agree.

    >> The short of it, for me, is that
    >> a) wired interfaces for non-movable things (hom= e gateways, fridges,
    >> furnaces) should not change their MAC address.&= nbsp; (Whether they use
    >> OUI derived addresses is a second question)
    >>
    >> b) Until WPA-Enterprise aka EAP-TLS,.. is ubiqu= itous among wifi IoT
    >> devices, that they should always use the same M= AC address for the
    >> same ESSID.

    > It's probably fine to change it periodically. = Right now, IIRC it's 24
    > hours for most vendors.

No, just Apple rotates on 24hr basis at this point.  Others could star= t.
The reason they do this has to do with the visibility of the MAC address, even when encrypted (see below).

Others have said that they support the same MAC on the same ESSID.
See the madinas slides from the BOF.

    >> Combining (a) and (b), I'm fine if wired device= s that do 802.1x want to do
    >> RCM.  That would apply to many security pa= ranoid enterprise
    >> desktops/laptops.  But, I don't think that= the IDS systems will be ready for
    >> a long time, as they mostly haven't caught up t= o IPv6 Temporary addresses yet.

    > If devices do 802.1X, then the authenticator can al= ready identify the
    > device.  The question then is which part of th= e network should be seen
    > as untrusted?

If they are doing 802.1X, then the authenticator, when it authenticates the=
device, already knows how to tell the network about the policy for the MAC<= br> address (whether permanent or dujour).
That's the point we need to get to for all devices that wish to do RCM.
Networks that aren't using 802.1X do not necessarily have that mechanism. This means 95% of home networks.

    > If the device is roaming, then it makes sense to hi= de it's identity
    > from the visited network.  It's also useful to= hide the device identity
    > on public WiFi frames.  But once 802.1X is don= e, the link to the AP is
    > secure.  And the device usually might as well = use it's own, physical
    > MAC address.

No, that's not true.

The MAC address part of the frame is not encrypted by wifi, only the payloa= d.
In many encryption modes, the MAC address is used as part of the input to t= he
CTR, Nonce or IV (depending upon mode), such that two devices with the same=
(WEP) key don't produce packets that are identical when encrypted.

--
]            &n= bsp;  Never tell me the odds!       = ;          | ipv6 mesh network= s [
]   Michael Richardson, Sandelman Software Works   = ;     |    IoT architect   [ ]     mcr@sandelman.ca  https://nam06.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.sand= elman.ca%2F&amp;data=3D04%7C01%7Ctim.cappalli%40microsoft.com%7C88a1636= 683ac467bbe6c08d9479ec449%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C6376= 19569525845289%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIi= LCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DApBsRqrPLeOiPK38EfXrt= %2BJK2A7TWzkhZfD734Mv3uo%3D&amp;reserved=3D0    = ;    |   ruby on rails    [




--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 I= =F8T consulting )
           Sandelman Soft= ware Works Inc, Ottawa and Worldwide




--_000_PH0PR00MB102997FB0CA238A23D222BC495129PH0PR00MB1029namp_-- From nobody Thu Jul 15 13:21:51 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AF3D3A1454; Thu, 15 Jul 2021 13:21:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.091 X-Spam-Level: X-Spam-Status: No, score=-2.091 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, SPF_PASS=-0.001, T_SPF_HELO_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=lear.ch Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pVcYkl8nxWap; Thu, 15 Jul 2021 13:21:43 -0700 (PDT) Received: from upstairs.ofcourseimright.com (upstairs.ofcourseimright.com [185.32.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D2733A1447; Thu, 15 Jul 2021 13:21:40 -0700 (PDT) Received: from Lear-Air.home (pool-173-54-226-148.nwrknj.fios.verizon.net [173.54.226.148]) (authenticated bits=0) by upstairs.ofcourseimright.com (8.15.2/8.15.2/Debian-18) with ESMTPSA id 16FKLbgN246310 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Thu, 15 Jul 2021 22:21:38 +0200 Authentication-Results: upstairs.ofcourseimright.com; dmarc=none (p=none dis=none) header.from=lear.ch DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=lear.ch; s=upstairs; t=1626380498; bh=zgk26I88AJQIbevlbMkd5Q1n8Y2ZbhSjDQhoyjQBSaU=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=bAZ5skqidNqTGqj/Ft94+zuq/68hIpOPkI4kUBNJtXNb2idEHkSDnx/bd8xGuAzMc VWUC7YIVhttNSlAWBzy06vEqumzzGTxMFItp8EGDx0n//Ue7bLuEAtql4L/GZsMZQl jjVytCMf8vbVNuDur8wNFz9UHNpL1wbbgDX+dB+Q= To: Robert Kisteleki , opsawg@ietf.org Cc: iotops@ietf.org References: <25526.1626054262@localhost> From: Eliot Lear Message-ID: Date: Thu, 15 Jul 2021 22:21:36 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="NQSqhNXjB9oJVNS5F11L4vEuVXCBpH2zB" Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 20:21:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NQSqhNXjB9oJVNS5F11L4vEuVXCBpH2zB Content-Type: multipart/mixed; boundary="6B7VR4jWyIplFrJIZ0k7PHY7BqJxyvbrv"; protected-headers="v1" From: Eliot Lear To: Robert Kisteleki , opsawg@ietf.org Cc: iotops@ietf.org Message-ID: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations References: <25526.1626054262@localhost> In-Reply-To: --6B7VR4jWyIplFrJIZ0k7PHY7BqJxyvbrv Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Content-Language: en-US What is and is not a good idea is highly contextual in this case.=C2=A0 T= he=20 network CAN provide a level of protection to limit attacks on devices,=20 but it can only do so if it knows who that device wants to talk to.=C2=A0= =20 There is no magic here.=C2=A0 Either the bindings can be established or t= hey=20 can't. Eliot On 15.07.21 13:53, Robert Kisteleki wrote: > >> This means that the resolver needs to be integrated with the MUD manag= er > > I think you're right. However, we also know this kind of bundling is=20 > not always a good idea, or even favourable. Like an init system that=20 > has a built-in network manager, DNS resolver or MUD controller :-) > > > but also that the IoT device should also be careful to observe >> caching semantics, particularly in the case of a connection failure.=20 > > Doesn't that prescribe that the IoT devices "should behave correctly"? = > Because we all know in reality they do not, at least not always -- but = > then what is a MUD controller supposed to do? Work around? Cover=20 > potential bad cases? Ignore this? > > Robert > --6B7VR4jWyIplFrJIZ0k7PHY7BqJxyvbrv-- --NQSqhNXjB9oJVNS5F11L4vEuVXCBpH2zB Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmDwmNAFAwAAAAAACgkQh7ZrRtnSejNj PAgAvNKVjMaIuD7QBiZt6UBlNa+jnxoEcRRWfOU/li0G+ZBmROd3V5SoWNLOIYwayMKWcqgSLZmz bp8v5qXbwjg3schZwZiwO1FJpVDYjZ8UFeD7NGbZGNAXE0vL5HOabHKGnfFH3AjX7mX2ygXLU4JR DciY4XjOSSizPAyv/HJ7+9DqUO5JhTDAyH00WclL6Fxr8CO/1uCZL1l1s2jzNC1wN6T8dSnETsE/ xWtEcH4V3PgS6kSWY4v448vGlE+WjU94JpkO/ar++e6LnZ3T628LP5B/NxJa1jSaaTyKMNtou3w9 96ZhPV70fdc2l56VI6eMtkqNMG+iKDQntMEiMtrLUQ== =MUsd -----END PGP SIGNATURE----- --NQSqhNXjB9oJVNS5F11L4vEuVXCBpH2zB-- From nobody Thu Jul 15 14:03:09 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7701A3A095A; Thu, 15 Jul 2021 14:03:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e3BR35Bh63t6; Thu, 15 Jul 2021 14:02:58 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADA833A094A; Thu, 15 Jul 2021 14:02:53 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id E6ABB38A95; Thu, 15 Jul 2021 17:05:52 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id dZV3hrmYCEFq; Thu, 15 Jul 2021 17:05:49 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 6459238A8D; Thu, 15 Jul 2021 17:05:49 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id DAE1A319; Thu, 15 Jul 2021 17:02:46 -0400 (EDT) From: Michael Richardson To: Eliot Lear , Robert Kisteleki , opsawg@ietf.org, iotops@ietf.org In-Reply-To: References: <25526.1626054262@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 21:03:04 -0000 Eliot Lear wrote: > What is and is not a good idea is highly contextual in this case.=C2= =A0 The > network CAN provide a level of protection to limit attacks on devices= , but it > can only do so if it knows who that device wants to talk to.=C2=A0 Th= ere is no > magic here.=C2=A0 Either the bindings can be established or they can'= t. Right. So the advice boils down to: Dear IoT device Manufacturer, if you want your device protected, then avoid playing DNS games that can not be described easily MUD. ---- Maybe the document would go better as a song? https://www.youtube.com/watch?v=3D0NnzChrd0S4 my new lyrics: A lonely MUD controller gazing out of the window Staring at a IoT device that she just can't touch If at any time, he's in a IoT attack, she'll be by his side But he doesn't realize he hurts the Internet so much But all the DNS-filtering just ain't helping at all 'Cause he can't seem to keep hisself out of 8.8.8.8 So he goes out and he connects to the cloud the best way he knows how Another TLS connection laying cold in the IDS Listen to me [Chorus: TLC] Don't go chasing DNS flows Please stick to the servers and the stub resolvers that you're used to I know that you're gonna have it your way or nothing at all But I think you're moving too fast -- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ From nobody Thu Jul 15 16:18:48 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3771B3A15D9; Thu, 15 Jul 2021 16:18:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.89 X-Spam-Level: X-Spam-Status: No, score=-0.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_ALL=0.8, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SPF_HELO_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=lear.ch Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UeNjm4z2Zh3j; Thu, 15 Jul 2021 16:18:36 -0700 (PDT) Received: from upstairs.ofcourseimright.com (upstairs.ofcourseimright.com [185.32.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9DDA3A15D0; Thu, 15 Jul 2021 16:18:35 -0700 (PDT) Received: from Lear-Air.home (pool-173-54-226-148.nwrknj.fios.verizon.net [173.54.226.148]) (authenticated bits=0) by upstairs.ofcourseimright.com (8.15.2/8.15.2/Debian-18) with ESMTPSA id 16FNIVrZ248155 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Fri, 16 Jul 2021 01:18:32 +0200 Authentication-Results: upstairs.ofcourseimright.com; dmarc=none (p=none dis=none) header.from=lear.ch DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=lear.ch; s=upstairs; t=1626391113; bh=SP9V50AZVcvVitkaPOYHpFJKdlQ8P/cBYVRy8iurLUo=; h=Subject:To:References:From:Date:In-Reply-To:From; b=NEk0GtB/gQ70PBP2cgusqIHINZIoRF1XEGk8lekSfSoDsNGzmFXiXC7I8KJPoPepU PAX5oy9pOy/rSI7OY4Wxgie+k+02qHPdCKJ9D3q79yxYh2oWGmK11BXTLRgOwGk71d hP1KxEIhsykflsgvIT8NEcJgpl5CSXWGaAMpmtj4= To: Michael Richardson , Robert Kisteleki , opsawg@ietf.org, iotops@ietf.org References: <25526.1626054262@localhost> <20862.1626382966@localhost> From: Eliot Lear Message-ID: Date: Thu, 15 Jul 2021 19:18:30 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <20862.1626382966@localhost> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="UyN44hlXYVDnkxVsUZPbZIUCpCa8jHkma" Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 23:18:42 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --UyN44hlXYVDnkxVsUZPbZIUCpCa8jHkma Content-Type: multipart/mixed; boundary="vm1RujteEhuhAGAD9o23oY8O531zDMWXy"; protected-headers="v1" From: Eliot Lear To: Michael Richardson , Robert Kisteleki , opsawg@ietf.org, iotops@ietf.org Message-ID: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations References: <25526.1626054262@localhost> <20862.1626382966@localhost> In-Reply-To: <20862.1626382966@localhost> --vm1RujteEhuhAGAD9o23oY8O531zDMWXy Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Content-Language: en-US I think the deployments also have to be somewhat forgiving in terms of=20 maintaining an ACL some period beyond TTL.=C2=A0 It would make a good pap= er=20 to understand just how much. On 15.07.21 23:02, Michael Richardson wrote: > Eliot Lear wrote: > > What is and is not a good idea is highly contextual in this case= =2E=C2=A0 The > > network CAN provide a level of protection to limit attacks on de= vices, but it > > can only do so if it knows who that device wants to talk to.=C2=A0= There is no > > magic here.=C2=A0 Either the bindings can be established or they= can't. > > Right. > So the advice boils down to: > > Dear IoT device Manufacturer, > if you want your device protected, > then avoid playing DNS games that can not be described easily MUD. > > ---- > > Maybe the document would go better as a song? > https://www.youtube.com/watch?v=3D0NnzChrd0S4 > > my new lyrics: > > A lonely MUD controller gazing out of the window > Staring at a IoT device that she just can't touch > If at any time, he's in a IoT attack, she'll be by his side > But he doesn't realize he hurts the Internet so much > But all the DNS-filtering just ain't helping at all > 'Cause he can't seem to keep hisself out of 8.8.8.8 > So he goes out and he connects to the cloud the best way he knows how > Another TLS connection laying cold in the IDS > Listen to me > > [Chorus: TLC] > Don't go chasing DNS flows > Please stick to the servers and the stub resolvers that you're used to > I know that you're gonna have it your way or nothing at all > But I think you're moving too fast > > -- > ] Never tell me the odds! | ipv6 mesh net= works [ > ] Michael Richardson, Sandelman Software Works | IoT archit= ect [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rai= ls [ > > --vm1RujteEhuhAGAD9o23oY8O531zDMWXy-- --UyN44hlXYVDnkxVsUZPbZIUCpCa8jHkma Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmDwwkYFAwAAAAAACgkQh7ZrRtnSejPY FQgAu5CiH0iuGcFJbxvyQPzZmMP+KYmuVRzFuPQk4by62EYy+m+w5izsGGDpG6sbwZ3I8UwYPd+6 3H7E1yc7U8wtkoUyU7opVtDNsRXt55o+QAJAIGTVa/CLnDeZ/SJnDOxyJaX5FN456n2xOSq4uM8O R6UTJowa70cEGQmDJ1iwvDlaMnTuPevHR7oPo1o5iVcPYiDct2E2BJPaCjRlasZjXnPF6jWTGLci OPpN0vO5PizCfk6YBdkQbucpALP40w03eKKT198Wz2ylA8hb+CQKFqjmaF4+FFPdWg2wVzm2KR9/ wD9tuAkVy1jn8HocpLnlXHpfypLtrsKvaav4yBWr8w== =FhxY -----END PGP SIGNATURE----- --UyN44hlXYVDnkxVsUZPbZIUCpCa8jHkma-- From nobody Fri Jul 16 01:04:32 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 579313A2BD0; Fri, 16 Jul 2021 01:04:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.596 X-Spam-Level: X-Spam-Status: No, score=-9.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=cdrhcu7O; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=jHOIxLPg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HJ8pP_B2PUbN; Fri, 16 Jul 2021 01:04:25 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DB0A3A2BC6; Fri, 16 Jul 2021 01:04:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2800; q=dns/txt; s=iport; t=1626422665; x=1627632265; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=3Bwak2vzEPp8g7SKomIflOX4Ha83TuQGNuRqNR5cMYA=; b=cdrhcu7OpZUAidli4sIstZQVpca1oYCxIUWr9jnL0i2FpQrNZBLLYGw0 D4rgNyWntkWH8U87dEOPwWYPMJQDb0aFeGhYvNCRDc7jw0KuJEs+c5Ak8 YlhTWf89EqGiD+jq7hfhH8YhWKI63zsOYyDWJodPMwa8luE7u71NuVnfu U=; X-IPAS-Result: =?us-ascii?q?A0DYAwD/PPFgl4UNJK1aHgEBCxIMQIMsKSh+WjcxhEiDS?= =?us-ascii?q?AOFOYhaA5ovglMDVAsBAQENAQExEAQBAYFggnQCF4JkAiU4EwIEAQEBAQMCA?= =?us-ascii?q?wEBAQEFAQEFAQEBAgEGBBQBAQEBAQEBAXKFaA2GRQEBAQQSEREMAQE3AQsEA?= =?us-ascii?q?gEIEQMBAgMCJgICAjAVCAgCBAENBSKCTwGCVQMvAQ6bBgGBOgKKH3qBMoEBg?= =?us-ascii?q?gcBAQYEBIJRgwAYgjIDBoEQKoJ7hA6GYiccgUlEgRUnDBCCMjA+gmIChHc2g?= =?us-ascii?q?i6CKgVsZEcQgRhGBh4qlTuVbJIUCoMkijWUBAUdCaZelgiMMphYAgQCBAUCD?= =?us-ascii?q?gEBBoFyIoFbcBVlAYI+UBkOjh8ZgQwBCIJDhRSFSnMCNgIGAQkBAQMJihIsg?= =?us-ascii?q?hsBAQ?= IronPort-PHdr: A9a23:aPUpYR2Pi7m47OqWsmDPS1BlVkEcU/3cJQcT5pcjjrtINK+qrNzuP 03asPNqilKBHYDW8OlNhOeetaf8EXcB7pCMvDFnEtRMWhYJhN9Qk1kmB8iIWlbyKvLnaykzG oJJXQwt83SyK0MAHsH4ahXbqWGz6jhHHBL5OEJ1K+35F5SUgd6w0rW5+obYZENDgz/uCY4= IronPort-HdrOrdr: A9a23:cI2N76BVnzc+fmnlHej6sseALOsnbusQ8zAXPh9KKCC9I/b3qy nxppsmPEfP+UkssHFJo6HmBEEZKUmstqKdkrNhQ4tKOzOW+ldATbsSrbcKpgeBJ8SQzJ8n6U 4NSdkaNDS0NykHsS+Y2nj8Lz9D+qj8zEnAv463pB0BIXAIGsNdBkVCe3um+yZNNW977O8CZe KhD7181kOdkBosH6CGL0hAe9KGi8zAlZrgbxJDLQUg8hOygTSh76O/OwSE3z8FOgk/hYsKwC zgqUjU96+ju/a0xlv3zGnI9albn9Pn159qGNGMsM4IMT/h4zzYI7iJGofy+gzdktvfsGrCo+ O8+CvI+P4DsU85S1vF+CcFHTOQjQrGpUWSlWNwykGT0PARDAhKe/apw7gpLScwLyEbzYBBOG Uh5RPGi3MfN2KzoMy2jeK4JC1Chw66p2EvnvUUiGEaWYwCaKVJpYha509NFowcdRiKpLzPPd MeRv003swmPG9yrkqpyFVH0ZipRDA+Dx2GSk8Ntoic1CVXhmlwyw8dyNYElnkN+ZohQ90cjt 60fJhAhfVLVIsbfKh9DOAOTY++DXHMWwvFNCaXLU78HK8KNnrRo9r84akz5uutZJsUpaFC16 jpQRddryo/akjuAcqB0NlC9Q3MWny0WXD3xsRX9/FCy/bBrXrQQGW+oXUV4oqdStkkc7nmss eISdtr6qXYXB7T8K5yrnrDZ6U= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.84,244,1620691200"; d="scan'208";a="724831319" Received: from alln-core-11.cisco.com ([173.36.13.133]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 16 Jul 2021 08:04:23 +0000 Received: from mail.cisco.com (xbe-aln-001.cisco.com [173.36.7.16]) by alln-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id 16G84No9032190 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Fri, 16 Jul 2021 08:04:23 GMT Received: from xfe-aln-005.cisco.com (173.37.135.125) by xbe-aln-001.cisco.com (173.36.7.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Fri, 16 Jul 2021 03:04:23 -0500 Received: from xfe-aln-002.cisco.com (173.37.135.122) by xfe-aln-005.cisco.com (173.37.135.125) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Fri, 16 Jul 2021 03:04:22 -0500 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (173.37.151.57) by xfe-aln-002.cisco.com (173.37.135.122) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15 via Frontend Transport; Fri, 16 Jul 2021 03:04:22 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mKkLw3u+zxfDgFJFG9yzJ3lMBLxo5jkdt0S0qLDuvCFXRjXtOus7x4sbbOFqQCfAXOnjX6yE4KJzfizbeZOm/CBqJsXzSynOTiCyBsCSfl5uujreJpSm+lrzq7T7PohyHjxVKXY5SzOrfz9VfVzEsfKp76lSAy+wRKE9T/grX8Li9JXp5EfrZfieyGTDyN9GRMYUeTnNyuY83L47lhYwLA7MwmfZAXqh3n9SWgChUvRxtOAMXsaraVpglsenn02+adsIYVmTTBsy/U43F1tix9FB6Nr48pCyrZkCx5gE12HIB9Klkmdpt+yXpbMXnq8fdiCSDDsc3iJT34wyd1IWsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3Bwak2vzEPp8g7SKomIflOX4Ha83TuQGNuRqNR5cMYA=; b=Ff9ThTbT2HLzNpXWeD/Kf7XgHbyCiIbq3PT7QZ0gBrODV61a342i1+KE4QCpaDE/TKqNyyDLPF71+nUfUfFdxl+gt34Qk1q1yTmrzi4faWhTspaPkG2mm8lsuIdaUSCVewUPzYtmiJ7gg8tDNIJwT2B7flxvrZR+YjlvhqgwWlO5qEuawGroVd2yfJFkfvejvy8JKK/gjsSrsVd6zX0C1z5Uxcc5Um31YGytmMNUhkfHdSjJ95Ukp+fH43O3xV+EP0nXNWeVSlaQfRAFEFShC8qL4JgjP7K/OkfAzPwI0Lw5Vhv3p5HdnoaksPb+g0NJlnBjWo5quiWyMCPdoW+oQg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3Bwak2vzEPp8g7SKomIflOX4Ha83TuQGNuRqNR5cMYA=; b=jHOIxLPgq+QBEmGF665+dT5HhMIyCc4lAUTQsvwgWA3YvJP/uJ+zDf7si80RXQUbr2KlwBwe1x76TmllWjWhBaR/VElPPDiG0nH8K4i/vreAJQEhby3fUMnN/IgsnVWbPmEDhb9Igx5F4XOkOCuteqTouQW64YbI0fp783dbN5I= Received: from PH0PR11MB4966.namprd11.prod.outlook.com (2603:10b6:510:42::21) by PH0PR11MB5158.namprd11.prod.outlook.com (2603:10b6:510:3b::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.24; Fri, 16 Jul 2021 08:04:21 +0000 Received: from PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::6d61:c160:def1:bc64]) by PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::6d61:c160:def1:bc64%3]) with mapi id 15.20.4331.026; Fri, 16 Jul 2021 08:04:21 +0000 From: "Eric Vyncke (evyncke)" To: Michael Richardson , "iotops@ietf.org" CC: "madinas@ietf.org" Thread-Topic: [Madinas] advice on IoT MAC address randomization (or not) Thread-Index: AQHXeOX0IUUbj0OY5U+dkX9UOZL096tFYfEA Date: Fri, 16 Jul 2021 08:04:21 +0000 Message-ID: References: <2660.1626290680@localhost> In-Reply-To: <2660.1626290680@localhost> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.51.21071101 authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none;sandelman.ca; dmarc=none action=none header.from=cisco.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1b21ae72-b695-4f39-a29a-08d9483051b7 x-ms-traffictypediagnostic: PH0PR11MB5158: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 6THO0VyhPvWbWqHfrWy3w+ey2bMiiIuM4+5XqEO7gDtW2URYcE+0+y5oCzECg7K2N4JQYPL9p/qKENbza3zkh1QCiE14l+G3YHdcCf/RBwyHNmf/TSzGLseO7tT2nEoa8lLWHud+Jw2hcFAXZAbH2IydJiU3g8YTOKf9dlhD6Kc/IG1ndn4/X7PABuQNjVq3rEq7Y/6d66E4aDsSEptT1ecwnoxIHfjjAc8pVh7og8ancs/vn1BrY4uEA1zXR2cM/vhIvfBIZcnkyOD91nIwx+xthOFM3NcCpapQvCXXP/TUjOWBtt3m3u9q3vKhAJobLush2AwWkApcb/6m/K3pCwrMOeq2jLHDSjUJZeea3ArP1d5vkPafMuvfc2SNRehVcXSwDjFSLJktdBUaxWa2IEPOTsjrx2faUBX1XnvOLldGwnW3KVvAC9uheMft7mZgFyVFnW93xOZU/KyL6oeJh+nOssbv/04sHN3SaFUunn8Qu75BHrJ0gK5Ha4OVvT9ZrQ/ds3d2j4SQDjzsa3JJ45GgMNFfHaYgy1baLqu30fS28TnM9bmbQqkznVU852OpFWcCbKTYuysDHOUWhdErk0831gxQFqTPuXI64q80Flnrp8qsVrw+g3Cg8oA25OlSpxK1nqXLNGtyCWpD9VnsKQXwtkd+omstp3oJbBrMRZjwbrdDHYE+KCS35Z2NwdGK3Vi9t1LkIpWXZvaHp5wjsgBzVj2dmZ9UuNmjYK1ThsQI3MelExA3jIJvF4smx6J3oZ4/7DPAwm5tay5lxfJOR3+hO07GxmQzxXZ5k4xyVDa2iQ6kbEu1hzhIo8iO0nwZ x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH0PR11MB4966.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(396003)(39860400002)(136003)(346002)(376002)(366004)(316002)(110136005)(4326008)(66574015)(53546011)(5660300002)(76116006)(71200400001)(66476007)(36756003)(66946007)(64756008)(33656002)(66556008)(91956017)(66446008)(83380400001)(86362001)(6486002)(186003)(8936002)(6506007)(8676002)(2616005)(26005)(966005)(6512007)(2906002)(478600001)(38100700002)(122000001)(38070700004)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?MWtQLytGb3NVNk1wc3Fub1hiMmFaR21MZ3BOcHlBVlZyR1Njc2ovR1J3TW4y?= =?utf-8?B?NVpWOHJ1R0VPMldvNHdVVEhHbFpQTnF0TEVrQ21BbitlR3UxeTZMczlvRDE3?= =?utf-8?B?WFYvY0kzdDZOVENYdEZtc2loYmN1MkhINTNnM1Z0SWo2UFNiSmdaZjAyNmZU?= =?utf-8?B?MmRNVDVGZjBnampjTUZtQWdFZUFXYWUwSEhHa0MvVHRYRGgyYTArNjQ2cjYr?= =?utf-8?B?Y2grMk51WlhPQm1BaHYwNXBjS1Q5Zm03eXdKdDR5VXpXZkNFdEVkUnJ4d2pa?= =?utf-8?B?Q0ZuSkhDN0dXbDEvNUdNek5aT0cyWnNmdzRrOWs1b25wYWw3bzVhL29BTXor?= =?utf-8?B?UU1rMW5Ia1I5dWNIYytMck9MMGc0THlhcGRpQ2Y1WWhMajlRclZWeUF6RFgr?= =?utf-8?B?WWYvQlJkb2hVWVhLemJSekw3czdBNlJuK04xSlNqWmFvNjcrZkZ3c0lLTjgr?= =?utf-8?B?VlNLK1Brc25GbXlTM2V5WUlQVS9zSXg2NjJtNmdKZFBma3RLd3h2SGVXTDFF?= =?utf-8?B?eHNwbHJYWis1a24wVGF1WFpGVU9tS3R2U1dKOUxFSE05RktLdDRwVzdqb2hq?= =?utf-8?B?cW0rUjFRd3ZMV1hKQXFsVmxYWVk2aEVacWh4VXd5QjZZNURwcXZOWThRa1dz?= =?utf-8?B?U1F2dTl2bnpBUHlCR2ZmYzJmc1pBMU9KRU1hN3RMYjVSSGJHNWpmRXd4RDkx?= =?utf-8?B?NVNWSm5GQVY2RjZqc042MFd5QWRBd1cyQUF2WHVLZnplckZ5bzdkcVFPOGpx?= =?utf-8?B?ZEpjNTNrZHkrWXJqWWJ1UThoOXllOFJnY3FvOEpWZ0pKWU9xMHhuR0FMcmVO?= =?utf-8?B?bk16ZHk4VFRtUTZ1am1FQTRyaHprN1p1ZklaRDE1K1NGR295b2FLTldpOTBt?= =?utf-8?B?L3p4WVY3b2FNbWp2R2J1M0M2OUpSeStNaDl5cGxBbFV4VWJpV0s1ZHJ5bDZG?= =?utf-8?B?amI2NWVWZTl2QlNZeVpGSkhEL2l1V21Xb1FmdCsrZ0NtaWNtR2s1WTBZN1Iy?= =?utf-8?B?a0t3bFBCdlpCamQrYVlPeGt5MVdNcnVKVnJDVUk5R3Rhcmg3STNCRitUdUw5?= =?utf-8?B?TEpITzNqVkJYVjhYYml1M2pJeDN1TkxsNnJwSHQwWHpvcXF5Q0hmWmwzQUFo?= =?utf-8?B?a1M0TlJ1V0dLdGNsMGwxL05JRXhRU2RueDl3d3ovUzdaM2dXb0pjQk5JOWdR?= =?utf-8?B?T2xnVlI4akFHV3hoRWFyc3ZSVkpwVDZtVzc4dURxNUM4cVZtdXV6VXQ3VllH?= =?utf-8?B?bi9VM2lFOVd3YzltbTFiYnlDcWtaWnRIbWhjdUNveWYrS0ExQnpFT25MZEJJ?= =?utf-8?B?VFFKRDlINnV0WnFpdVEzS0VscEF3UU5BVmZlYUhEb2F3NVYxT2JOMEtMcER6?= =?utf-8?B?YzBPajMxSWFhcXE1bVc4RWp3UTUrRC9xSTNNcTA1UWVoMGhybEVOVzVlUkhW?= =?utf-8?B?Wm5HMkFEclV0aEEyK085bXY0UzVjSUlkQkgxMDJvMEhOTkxZMFh2T2ZZNTJF?= =?utf-8?B?Z3JvY0xLOGNXOE9iZWMvVGZXZHUzL3dHV3FOZFVqMm5VelM0c1l4RHBpbUEz?= =?utf-8?B?VlU0Ty9sR3gwU1BvaEtNblFBcllWdmc2ZFV2cFMyL2k4ZTlub05BclBXcWEz?= =?utf-8?B?RHpDMVZidkxJazZ0UnA0dWpKM1h3dHpDUzFyM0dvOHBLdmpIeHM3WURva2FY?= =?utf-8?B?ZHRWZUtpeGdpWWNDbFMxMkZpL01UYStBcUc1eGt1TjRqSHFkQWlvd3VXMExv?= =?utf-8?B?dG5jTnlyODZxci8wcGVCbzFaTVlNYnRqYWNWZTZVS3dpWW8xNzgyRlh0a1Q3?= =?utf-8?B?Tit0bVpSY1g5US9EazExZz09?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4966.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1b21ae72-b695-4f39-a29a-08d9483051b7 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2021 08:04:21.5239 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: PA+jQChtwtU6mSInhdVzTOFcDecgyE0bL/dipK6x+aM+3vbx52ZRmsOS/0Tdt5moogm2QVNmSPadRCNMTwpJMQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5158 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.16, xbe-aln-001.cisco.com X-Outbound-Node: alln-core-11.cisco.com Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jul 2021 08:04:30 -0000 TWljaGFlbCwNCg0KUXVpY2sgcmVwbHkgb24gdGhlIGFic2VuY2Ugb2YgY2hhcnRlciBvbiB0aGUg TUFESU5BUyBwYWdlIG9uIHRoZSBkYXRhIHRyYWNrZXI6IEFGQUlLLCB0aGUgY2hhcnRlciBhcHBl YXJzIG9ubHkgd2hlbiB0aGVyZSBpcyBhIGJlaW5nLWNoYXJ0ZXJlZCBXRyBhbmQgTUFESU5BUyBp cyBzdGlsbCBhIFdHLWZvcm1pbmcgQm9GIF9fIFRoZSBkZXNjcmlwdGlvbiBpcyBvbiB0aGUgQm9G IFdpa2kgaHR0cHM6Ly90cmFjLnRvb2xzLmlldGYub3JnL2JvZi90cmFjLw0KDQpFbHNlLCBJTUhP LCBJb1Qgc2hvdWxkIGFsc28gYmUgaW4gdGhlIHVzZSBjYXNlcyBvZiBNQURJTkFTIGZvciB0aGUg cmVhc29uIHlvdSBjaXRlZC4NCg0KUmVnYXJkcw0KDQotw6lyaWMNCg0K77u/LS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCkZyb206IE1hZGluYXMgPG1hZGluYXMtYm91bmNlc0BpZXRmLm9yZz4g b24gYmVoYWxmIG9mIE1pY2hhZWwgUmljaGFyZHNvbiA8bWNyK2lldGZAc2FuZGVsbWFuLmNhPg0K RGF0ZTogV2VkbmVzZGF5LCAxNCBKdWx5IDIwMjEgYXQgMjE6MjUNClRvOiAiaW90b3BzQGlldGYu b3JnIiA8aW90b3BzQGlldGYub3JnPg0KQ2M6ICJtYWRpbmFzQGlldGYub3JnIiA8bWFkaW5hc0Bp ZXRmLm9yZz4NClN1YmplY3Q6IFtNYWRpbmFzXSBhZHZpY2Ugb24gSW9UIE1BQyBhZGRyZXNzIHJh bmRvbWl6YXRpb24gKG9yIG5vdCkNCg0KDQogICAgSSdtIG5vdCBzdXJlIHdoZXJlIHRoZSBtYWRp bmFzIGNoYXJ0ZXIgaXMsIHRoZSBfTUFESU5BUyAtIFByb3Bvc2VkIENoYXJ0ZXINCiAgICB2Ml8g dGhyZWFkIGZyb20gdGhlIGVuZCBvZiBNYXkgcGV0ZXJlZCBvdXQuICBJIGRvbid0IHNlZSBhIGNo YXJ0ZXIgaW4gdGhlDQogICAgV0cvQk9GIGVudHJ5IG9uIHRoZSBkYXRhdHJhY2tlci4NCg0KICAg IEEgQkNQIGRvY3VtZW50IGlzIG1lbnRpb25lZC4NCg0KICAgIEkgdGhpbmsgdGhhdCBhIEJDUCBk b2N1bWVudCBvbiBJb1QgZGV2aWNlcywgaW5jbHVkaW5nIHJvdXRlcnMsDQogICAgc3dpdGNoZXMg YW5kIG90aGVyIGluZnJhc3RydWN0dXJlIHdvdWxkIGJlIGdvb2QuDQoNCiAgICBUaGUgc2hvcnQg b2YgaXQsIGZvciBtZSwgaXMgdGhhdA0KICAgICAgYSkgd2lyZWQgaW50ZXJmYWNlcyBmb3Igbm9u LW1vdmFibGUgdGhpbmdzIChob21lIGdhdGV3YXlzLCBmcmlkZ2VzLA0KICAgICAgICAgZnVybmFj ZXMpIHNob3VsZCBub3QgY2hhbmdlIHRoZWlyIE1BQyBhZGRyZXNzLiAgKFdoZXRoZXIgdGhleSB1 c2UNCiAgICAgICAgIE9VSSBkZXJpdmVkIGFkZHJlc3NlcyBpcyBhIHNlY29uZCBxdWVzdGlvbikN Cg0KICAgICAgYikgVW50aWwgV1BBLUVudGVycHJpc2UgYWthIEVBUC1UTFMsLi4gaXMgdWJpcXVp dG91cyBhbW9uZyB3aWZpIElvVA0KICAgICAgICAgZGV2aWNlcywgdGhhdCB0aGV5IHNob3VsZCBh bHdheXMgdXNlIHRoZSBzYW1lIE1BQyBhZGRyZXNzIGZvciB0aGUNCiAgICAgICAgIHNhbWUgRVNT SUQuDQoNCiAgICBDb21iaW5pbmcgKGEpIGFuZCAoYiksIEknbSBmaW5lIGlmIHdpcmVkIGRldmlj ZXMgdGhhdCBkbyA4MDIuMXggd2FudCB0byBkbw0KICAgIFJDTS4gIFRoYXQgd291bGQgYXBwbHkg dG8gbWFueSBzZWN1cml0eSBwYXJhbm9pZCBlbnRlcnByaXNlDQogICAgZGVza3RvcHMvbGFwdG9w cy4gIEJ1dCwgSSBkb24ndCB0aGluayB0aGF0IHRoZSBJRFMgc3lzdGVtcyB3aWxsIGJlIHJlYWR5 IGZvcg0KICAgIGEgbG9uZyB0aW1lLCBhcyB0aGV5IG1vc3RseSBoYXZlbid0IGNhdWdodCB1cCB0 byBJUHY2IFRlbXBvcmFyeSBhZGRyZXNzZXMgeWV0Lg0KDQogICAgSXQncyBwcm9iYWJseSBmaXZl IHBhZ2VzIG9mIGp1c3RpZmljYXRpb24gZm9yIGVhY2ggcG9pbnQgSSBtYWtlIGFib3ZlLCBzaWdo Lg0KDQogICAgLS0NCiAgICBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitJRVRGQHNhbmRlbG1hbi5j YT4gICAuIG8gTyAoIElQdjYgScO4VCBjb25zdWx0aW5nICkNCiAgICAgICAgICAgICAgIFNhbmRl bG1hbiBTb2Z0d2FyZSBXb3JrcyBJbmMsIE90dGF3YSBhbmQgV29ybGR3aWRlDQoNCg0K From nobody Fri Jul 16 09:16:38 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D1763A3C28; Fri, 16 Jul 2021 09:16:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BdeWMyD-wY4O; Fri, 16 Jul 2021 09:16:31 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 123D23A3C26; Fri, 16 Jul 2021 09:16:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 773F338A6B; Fri, 16 Jul 2021 12:19:34 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id WgbIpklFAyqv; Fri, 16 Jul 2021 12:19:31 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 43D1038A6A; Fri, 16 Jul 2021 12:19:31 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id B1B3A407; Fri, 16 Jul 2021 12:16:25 -0400 (EDT) From: Michael Richardson To: Eliot Lear , Robert Kisteleki , opsawg@ietf.org, iotops@ietf.org In-Reply-To: References: <25526.1626054262@localhost> <20862.1626382966@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jul 2021 16:16:37 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Eliot Lear wrote: > I think the deployments also have to be somewhat forgiving in terms of > maintaining an ACL some period beyond TTL.=C2=A0 It would make a good= paper to > understand just how much. Yes, I agree. When one does a DNS lookup, the TTL one gets back is the amount of time that it's valid in that cache. At the point where it expires, one should do another lookup of that QNAME. If an A or AAAA is now gone, I think that that maintaining a positive ACL for another TTL worth makes sense. If it was a negative ACL (traffic forbidden), then I'd remove it immediatel= y. (MUD doesn't really do negative ACLs) =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDxsNkACgkQgItw+93Q 3WXjNAf9F8AgSMfwKNg83nWiIkCOonEqwzAK06ZsbIP8q/P+Q3tJ8XCje0wmu7Vh s6TlWkAfkoRULsBsbIUSkJKCk0cp/jvR9ZGUacdLERi+HcgFcVhpNu8EuoYNcffN ho4ypPHIJgrXtnV0Rg49Gue2oFpgpJerWidnyagczrOkknenevXcB3DtKpHJ/uc+ SLaEPgQo4zl+mGyirtigPEggUQfRZovbL8Lf7D4gLtxW217RyLvJD2JjNjNkJ2H4 vj5da0/Hu/+k73fDTJEFU3T67Oj1rdgJ5V17K3zpNyGwIZvlUesAgfGcUWvcFg++ fuBvJkRsz7aKp35O8PUO1p0Om0cG1Q== =/PCw -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jul 16 09:22:20 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76F853A3C4A; Fri, 16 Jul 2021 09:22:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FVsz_dMfHQCS; Fri, 16 Jul 2021 09:22:13 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAEFC3A3C47; Fri, 16 Jul 2021 09:22:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 211B438A6D; Fri, 16 Jul 2021 12:25:16 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 0VpPtc8mraSd; Fri, 16 Jul 2021 12:25:12 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id CD7B138A6B; Fri, 16 Jul 2021 12:25:12 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 52163407; Fri, 16 Jul 2021 12:22:07 -0400 (EDT) From: Michael Richardson To: "Eric Vyncke \(evyncke\)" , "iotops\@ietf.org" , "madinas\@ietf.org" In-Reply-To: References: <2660.1626290680@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jul 2021 16:22:19 -0000 --=-=-= Content-Type: text/plain Eric Vyncke (evyncke) wrote: > Quick reply on the absence of charter on the MADINAS page on the data > tracker: AFAIK, the charter appears only when there is a > being-chartered WG and MADINAS is still a WG-forming BoF __ I thought that you could insert the proposed charter into the DT at any time. > The description is on the BoF Wiki https://trac.tools.ietf.org/bof/trac/ That's the wiki we are trying to kill, right :-) Is it in github somewhere that people can do word smithin? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDxsi8ACgkQgItw+93Q 3WU9KwgAiSQAy00cyXjNdgzBP7nuHhr3N+WrJxAs4BRPoVF8AZo6by0R70wzmkH+ O/YJE7ccY/BJrXDZ+kwaDtxKvuJAnODKs5GQVg7u9ThaiqrJXz8JnbEtmDCib1zw LHVZYjGm9gnshhoZGImD6uN/upLvUNSCRleL8Nf0U6jtt2NN/KZbWMjCd8QKk+SF BrB9OZ2gfUzNmZxIG7co9K2yNuPUmXgNaX44w4KgkNkm4NoeBAEBpPo11TjQMlxz eA2ZNzPX7L0+kfUM7gDK7sOndBqdigw1giAdj9mvkBDi6ltLswAFSL9RPP0AyIMZ ++kTHn8Cc07gutunXNXXV6j75hnYAg== =J9GM -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jul 16 09:45:14 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61B933A0DFA; Fri, 16 Jul 2021 09:45:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5ZnOL6vpWehS; Fri, 16 Jul 2021 09:45:07 -0700 (PDT) Received: from gabriel-smtp.zfn.uni-bremen.de (smtp.uni-bremen.de [134.102.50.15]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A8F83A0DF9; Fri, 16 Jul 2021 09:45:07 -0700 (PDT) Received: from [192.168.217.118] (p548dcc89.dip0.t-ipconnect.de [84.141.204.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-smtp.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4GRHCc5ftvz2xLX; Fri, 16 Jul 2021 18:45:00 +0200 (CEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) From: Carsten Bormann In-Reply-To: <30852.1626378085@localhost> Date: Fri, 16 Jul 2021 18:45:00 +0200 Cc: opsawg@ietf.org, iotops@ietf.org X-Mao-Original-Outgoing-Id: 648146700.377526-b7be4f88bc584f71fc831448ee24c155 Content-Transfer-Encoding: quoted-printable Message-Id: References: <25526.1626054262@localhost> <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> <8763.1626373016@localhost> <30852.1626378085@localhost> To: Michael Richardson X-Mailer: Apple Mail (2.3608.120.23.2.7) Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jul 2021 16:45:13 -0000 On 2021-07-15, at 21:41, Michael Richardson = wrote: >=20 > How, does an authoritative (or even authoritarian) firewall identify = itself > such that traffic that needs to traverse it can self-identify? > APN has this problem. > I described this problem back in 1996: > https://www.ietf.org/archive/id/draft-richardson-ipsec-aft-00.txt > = https://www.ietf.org/archive/id/draft-richardson-ipsec-traversal-01.txt I think one trap that many of these efforts fell into was that they = tried to be small attachments to existing technology. There is nothing wrong with describing a little hack that has some = useful applications, but that won=E2=80=99t cover the gamut of use cases = that we really have. Looking at these uses cases we need to derive an understanding of the = parties involved and what security (and =E2=80=9Ctrust=E2=80=9D) = relationships they have, and what granularity of authorization of = =E2=80=9Cdesirable=E2=80=9D traffic is required, desired, and = achievable. Note also the term =E2=80=9Cjustifiable=E2=80=9D in my problem = statement! Only then can we check whether a proposed solution actually solves a = large enough problem. Gr=C3=BC=C3=9Fe, Carsten From nobody Fri Jul 16 10:16:52 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 769953A3E30; Fri, 16 Jul 2021 10:16:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sigfox.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FGKccyFQeMkT; Fri, 16 Jul 2021 10:16:41 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80125.outbound.protection.outlook.com [40.107.8.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE8AF3A3E2E; Fri, 16 Jul 2021 10:16:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AGKhYZRDCQcB/qTuLHtlv0EqCnuamFYGaCxHq1uCzl2XiR729rdzCmDvknrOaXI1fyvB+uOY3gVvqWmd/dz6BirMNvBTWyZY2aMS+7QY8Rp4LdM0PuMQauDqI/l8E3fR+d39gZxa3Uuq+kFVWL0LsVzLx7rsWgoE7TyN+xOBT6c0s+k1lV4/stjJLMzxx2OIEoxzjny52dN0/ZlSeX88jfnDo5BjgcDM/E2hjxqIQP+lPaAkO/w2zPpXs5C0YImMQH2V6whGcewsqwz6VTU5+8QXdn2rzC1KTkSSQDJC5CyJBsbmQkFrHvSYzUNNGjdrj3jp7rk56EHMrIV9VcFkhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s6IZSKnkDvKjPFtE2x6OXIr4U54zWwoOLBQ5YR/wNFA=; b=e5lwOKOSpdGQPkgxAl53Lg8Lh58N2RdDsX4AwV7K9UrF/ZfEk9Scdi1z/dxE8M+vcD/zlPafkX59N4ZvJvrBtP+LyjV5G5kcGunlHYveMqlY2z0EY5fVRC82O+xaXceVOs+D9O5tcAe3w24MXhSIN2bTrISFWJKQKkN80XAGaBh6bxna2zxbQfnylMZhfDCkyksgs5WcNOYRAhZZYD8bhj9zxnYZOdaeT2Jc+r48hXT3RSDvLYQI46cgudGMPfC0cCq9R7TtG1Y52kK0yIgi9NRnaUyRpZxIKhSJZMht5BXD1RqAHzetnjqFTC5hfBiO32yVh+vfptoo2QDnDr9SBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=sigfox.com; dmarc=pass action=none header.from=sigfox.com; dkim=pass header.d=sigfox.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigfox.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s6IZSKnkDvKjPFtE2x6OXIr4U54zWwoOLBQ5YR/wNFA=; b=LFzo/uSoaXYPSN883kaageCVvL8MI96Xx1vCVogHpj4GQByfiKGH3t3LuradvqEDOzxnVbXvzcBo1tzRU+F2cUxeOF8EqMBh0vBQmjmZhh0Po9YzL3mS7oP3R8Ik3tJQoH09+fZ9QyKJWO0jNL5U2mAdgxXbJbd2UjHYU/azoqc= Received: from DB7PR08MB3179.eurprd08.prod.outlook.com (2603:10a6:5:25::29) by DB7PR08MB3402.eurprd08.prod.outlook.com (2603:10a6:10:4f::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.23; Fri, 16 Jul 2021 17:16:37 +0000 Received: from DB7PR08MB3179.eurprd08.prod.outlook.com ([fe80::f048:c6d1:955e:432d]) by DB7PR08MB3179.eurprd08.prod.outlook.com ([fe80::f048:c6d1:955e:432d%4]) with mapi id 15.20.4331.023; Fri, 16 Jul 2021 17:16:37 +0000 From: Juan Carlos Zuniga To: Michael Richardson CC: "Eric Vyncke (evyncke)" , "iotops@ietf.org" , "madinas@ietf.org" Thread-Topic: [Madinas] advice on IoT MAC address randomization (or not) Thread-Index: AQHXeOYUoVYm936dgEykub/CVF3q7KtFQJGAgACLE4CAAA4MQA== Date: Fri, 16 Jul 2021 17:16:37 +0000 Message-ID: References: <2660.1626290680@localhost> <1347.1626452527@localhost> In-Reply-To: <1347.1626452527@localhost> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none;sandelman.ca; dmarc=none action=none header.from=sigfox.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b9271ba8-26d8-43ae-59a6-08d9487d784f x-ms-traffictypediagnostic: DB7PR08MB3402: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: XFJeMHbAxnJnvXXuOd4LStOBDLfqx+kvCJIKO7odrxtby8g/vK0H3R+2LXjtnHwpoWIdyZi75pUjXrsgYaWR5io/TTbS5TwCbowzkBCNOAignCcIeRgTyDd1UkpRcq27+R1nZp+WjT5vi/CMxKaEz5xRYZ8N+Xv6PeFcxbJBmmE/w2z6hso/+eAvM7Dl8I335aVJww55w2YiA3hc6HtwpTOVcih7biP3JRt154FMZbKCqDU3SV9NBvZcuCdhgvp5dvFQdxQWmqrek/x3TsP9O3bi+5g26Y08mrEXnsg93rpYw0gKHA/G9PDLlATFvdAWMjdGar/oKzo1iPomIhm3X9IOkWDDwUot3PUAd/FN7GPbNji093uvWAs7bTAqfXRgW0jTzGqStMRh/4OU7pl/SxMUxLtzSbt+fuRP7tb8oA8tVuRDRT0ykLQuLb/XuzAqvMC3oywFzuBvvMF+kVANyMywwh35ufFnCGUoTfU3LGMWtbEBqB5rjmKRtbEE8OvuiPpMVC4Zv4ws7loskeWSJysI5Z25pnUvW65aqbLRMYNNZ82kVGyLMNcBVxiNexyz4bQN1bYKwuClsgs/8244Vc3CnwO4totsLc+2YP1YIyIBSLcKhrSK7oNHfSNm05ci4vaZhaACorx3ocl2N7nmZARfzjl/3ncdIfHPbuhbCHwJmT+KDUG645aTjSsIET4H5p/kseiwxuNVggG35ovSYyP5Taosf+ZCguWYg2xWr2C6MoOimkqJpiW4X9M6nve5+tUQLVIkGibRczqZrxbmlhjZlhJJY6hIbgAU6lXp8uk= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB7PR08MB3179.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39840400004)(376002)(396003)(346002)(136003)(366004)(478600001)(966005)(52536014)(45080400002)(8936002)(76116006)(64756008)(66946007)(66446008)(66556008)(6916009)(5660300002)(9686003)(66476007)(86362001)(55016002)(54906003)(71200400001)(4326008)(2906002)(6506007)(33656002)(316002)(38100700002)(8676002)(186003)(122000001)(83380400001)(7696005)(26005)(38070700004); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?IOkC3XvNVgobJjEbbtzT13BA5N1O287ZxXfMMiZJQFug8f0+YxSEXr2cYa9l?= =?us-ascii?Q?HNqXB6EDRp9fKVwBHVlS0oiLR/3j6PHFi8JL6CZCSE5kBV2QSXyo/KJ6AbcF?= =?us-ascii?Q?f/H2m+9KpWzodeYjK5zrPjjJ+xxVDtWSnKruO/bc5IKWczXsCEVpt/2G33aw?= =?us-ascii?Q?DaNttgFR0+XX35AYxmPfVZ6vLDyu+uoPQg5u29AYSXoYzBA/tYJp/xt86Dzm?= =?us-ascii?Q?iaarYsZMzfvAl9HwFJXWmFaLMbO0R5Y5VvT41o/ZIW7j8ljbmLbtK2oIXSc2?= =?us-ascii?Q?AndGcTCttUhrHQlzlE41CYNOuaxw/jYzvbtxnpiEkXfZGkRkp4PUGpD1clYq?= =?us-ascii?Q?WS3ZSyMPrXxQBv/D82sfnOJWhm3Z+Be+4OAvx36JJuFYgyLfuTkiCZhFV7R0?= =?us-ascii?Q?tKiBqsDYfQw1BW4x2+MfODGZL4KvIB91rQYUe4I/Ej1waUOI520BqGr4+zp6?= =?us-ascii?Q?X0GqxfRJScjshQdKAQ7yS0dk8R7I3obMY8WUYLj4t1cT84PKsVZJ2PrZ3RpJ?= =?us-ascii?Q?MXGbuMesJJ2vwNJJKltDDCWyyMswjfQNNDPV0GZ6NvLgWsrvGxqjL8sYlbTX?= =?us-ascii?Q?XqABlTDoJaTxL/oKzTxdFTj3669yc6QGsu7oi5mrGHxY6GIm8+Vl/tzwDHCu?= =?us-ascii?Q?IBgu1wTKxTD1VcBwm0cuZmSf+c7gKbbnw+0D8FxLYTUKu6aL6SJ1TvBacIj+?= =?us-ascii?Q?kHXoQZnS11eczAh5Z96ilGG0OnezH+IZeBXkl4YqdQclAmoRh3jnASSMml97?= =?us-ascii?Q?ttmtSk/ms5yTzadC4rXmEDdgW96QxxFqvTGfr0RMWuFQ2DItQN7p2LdqEvGW?= =?us-ascii?Q?hvK/5GUS0+vLcKm/OSW23BZQ2MmygTHV/MBdQZlcnD+FaJb5q1xzk6ipI2Ex?= =?us-ascii?Q?L2hQbKYO4XUkdJBP17l7a9o+NQShrAymiRqhYW/UCr+InkSOE+kbBTZu6dcx?= =?us-ascii?Q?NhYf5yARfPCeHz3mgXQ/dMXoZArGLv1OJxl1/E+QiHpAV6Kuvc9boZ1Z6a2C?= =?us-ascii?Q?9/Aq5te5wjCumrn8siKM+CRhZ8W6DAaQ7i+tZ3cyEtvqL6gZHj26Axc8YiL6?= =?us-ascii?Q?uyinsKrMJLdA4ResprexbII/CusD/G7jgEY3hmO89tk5FEeT+xX00uBYrDIi?= =?us-ascii?Q?LniS5LLZiDCUyUwj+cWORQzXIOH89ZPv6PeaRvYZb+lHeYTdzhGaZxhx5SoM?= =?us-ascii?Q?9a80vdYviYE+nK6Xzfteq3HnriKYFv1nBfa/YpHlq/5PEHky/Lgu3l8E56r7?= =?us-ascii?Q?qjPkRry9peyQKtVlOxjxl6/udLF1XxApNGQ0Qnz4Ya+oSHC37/8SAn7aA1B+?= =?us-ascii?Q?vvdeWtK6eyPDRhYg8jVm6ox/?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: sigfox.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DB7PR08MB3179.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: b9271ba8-26d8-43ae-59a6-08d9487d784f X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2021 17:16:37.5464 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fcbc8bb1-061e-4b94-9f70-3ad917b0c8d3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: HCfNIZZC/1Q1BX/V0yfFf33Lt2iCUy+8Iul+yGnW9rp/o5Gvu7gvv4POaH9gHYw97vEVBgp/zn2CbJ5dnfL/w3wee+ERJQLDnJyanPuPp44= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR08MB3402 Archived-At: Subject: Re: [Iotops] [Madinas] advice on IoT MAC address randomization (or not) X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jul 2021 17:16:47 -0000 > Eric Vyncke (evyncke) wrote: > > Quick reply on the absence of charter on the MADINAS page on the da= ta > > tracker: AFAIK, the charter appears only when there is a > > being-chartered WG and MADINAS is still a WG-forming BoF __ >=20 > I thought that you could insert the proposed charter into the DT at any t= ime. >=20 > > The description is on the BoF Wiki > https://eur03.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftrac.= tool > s.ietf.org%2Fbof%2Ftrac%2F&data=3D04%7C01%7Cjuancarlos.zuniga%40sig > fox.com%7C6e737d741124424c09cc08d94875e9f7%7Cfcbc8bb1061e4b949f7 > 03ad917b0c8d3%7C0%7C0%7C637620494151675801%7CUnknown%7CTWFp > bGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6 > Mn0%3D%7C3000&sdata=3DsBTliX%2Bo3ykqAZza5cTzX%2F7kHmgY8S7Lbb > 5W7WBpwgk%3D&reserved=3D0 >=20 > That's the wiki we are trying to kill, right :-) Is it in github somewher= e that > people can do word smithin? [JCZ] We will compile comments received on the ML and will edit the propose= d MADINAS Charter accordingly, so that we can present and discuss at the up= coming BoF. If you have any suggestions, please send them by responding to the email th= read: https://mailarchive.ietf.org/arch/msg/madinas/jlQsSGsBgHqnAMTj8pFOV8Gsu_U/ Juan Carlos=20 From nobody Fri Jul 16 13:42:29 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3ED493A0817; Fri, 16 Jul 2021 13:42:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RnlPBcBMUfTu; Fri, 16 Jul 2021 13:42:21 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8966C3A0816; Fri, 16 Jul 2021 13:42:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 090E038A72; Fri, 16 Jul 2021 16:45:25 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id y3wrJwNG8sUC; Fri, 16 Jul 2021 16:45:21 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id D071F38A48; Fri, 16 Jul 2021 16:45:20 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 532B7407; Fri, 16 Jul 2021 16:42:14 -0400 (EDT) From: Michael Richardson To: Carsten Bormann cc: opsawg@ietf.org, iotops@ietf.org In-Reply-To: References: <25526.1626054262@localhost> <6F3C1EA9-DB7F-4E29-BA31-D7835C1CFBB4@tzi.org> <8763.1626373016@localhost> <30852.1626378085@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jul 2021 20:42:27 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Carsten Bormann wrote: > On 2021-07-15, at 21:41, Michael Richardson w= rote: >> >> How, does an authoritative (or even authoritarian) firewall identify= itself >> such that traffic that needs to traverse it can self-identify? >> APN has this problem. >> I described this problem back in 1996: >> https://www.ietf.org/archive/id/draft-richardson-ipsec-aft-00.txt >> https://www.ietf.org/archive/id/draft-richardson-ipsec-traversal-01.= txt > I think one trap that many of these efforts fell into was that they > tried to be small attachments to existing technology. In 1996, I'm not sure I'd say that IPsec was "existing" :-) The pushback that I got was that it seemed complex. NAT44 was not established, but it was visible in the form of actual securit= y gateways. > Looking at these uses cases we need to derive an understanding of the > parties involved and what security (and =E2=80=9Ctrust=E2=80=9D) rela= tionships they > have, and what granularity of authorization of =E2=80=9Cdesirable=E2= =80=9D traffic is > required, desired, and achievable. Some things have progressed in 25 years. RPKI exists, although it is not well deployed. (My understanding is that o= ne reason it is slow in ARIN region is that ARIN won't let you have their publ= ic key until you assure them you won't sue...) RPKI would allow a node to say, "I am authoritative for 2001:db8:1234/48" This could be very powerful if used correctly. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmDx7yYACgkQgItw+93Q 3WWIlwgAhqZCDD2W4tV4to10gQCwVhU2Oo/iFZ7mHzmpq1UzvL6A5IbJZ/WcWp8K NaXs0cGCB9xFOZnpFn8ilARuVWZH9qNYgyN9rGRZl0qtCIjMzeoX/peGfFNhHLaa rzi2yqagguhh7n1+CtzU5fNxqK7PUI6shDNZegtlXsPdz9QoiDSkEl7XLNGjoXis dw2nNlrqlHv8lFBbjSTDl+FKhj/0ebFUIutfQVuJg4V/ngLyo6CygDgTM/jzJ+wj q5js7xyKlWvC5hx0mYg5pFzX9G6ThQAK6XiuVs99CuJi+EbHO0zwG1cmBEAeRD+s DEZ41mr7S4sHcVz3cjfB9SvJMVtiRQ== =0Kho -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Jul 26 15:03:31 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D83953A154F for ; Mon, 26 Jul 2021 15:03:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.232 X-Spam-Level: X-Spam-Status: No, score=-0.232 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MAY_BE_FORGED=1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_SOFTFAIL=0.665, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HVKFR4iDqRHi for ; Mon, 26 Jul 2021 15:03:15 -0700 (PDT) Received: from c.mail.sonic.net (c.mail.sonic.net [64.142.111.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E03163A1503 for ; Mon, 26 Jul 2021 15:03:09 -0700 (PDT) Received: from [192.168.10.45] (mac76-3_migr-88-162-14-77.fbx.proxad.net [88.162.14.77] (may be forged)) (authenticated bits=0) by c.mail.sonic.net (8.15.1/8.15.1) with ESMTPSA id 16QM2uYH015637 (version=TLSv1.2 cipher=AES128-GCM-SHA256 bits=128 verify=NOT); Mon, 26 Jul 2021 15:02:57 -0700 References: <162733690703.2852.10131076597579602787@ietfa.amsl.com> To: iotops@ietf.org From: Erik Nordmark X-Forwarded-Message-Id: <162733690703.2852.10131076597579602787@ietfa.amsl.com> Message-ID: <1456b8bd-dd21-8e13-1f62-ac36a24a786b@acm.org> Date: Tue, 27 Jul 2021 00:02:55 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <162733690703.2852.10131076597579602787@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Sonic-CAuth: UmFuZG9tSValUURpFNI24QVBiqtIssXyRngMUiWHulyGYamMaufzVpEPuU7mlKxce1yRi1LzAbqEZZ8gSrsZ4RAygJU30JhM X-Sonic-ID: C;LNOQO13u6xGp/NvKcSgy2w== M;YKBXPF3u6xGp/NvKcSgy2w== X-Sonic-Spam-Details: 0.0/5.0 by cerberusd Archived-At: Subject: [Iotops] Fwd: New Version Notification for draft-nordmark-iotops-onboarding-00.txt X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Jul 2021 22:03:29 -0000 -------- Forwarded Message -------- Subject: New Version Notification for draft-nordmark-iotops-onboarding-00.txt Date: Mon, 26 Jul 2021 15:01:47 -0700 From: internet-drafts@ietf.org To: Erik Nordmark A new version of I-D, draft-nordmark-iotops-onboarding-00.txt has been successfully submitted by Erik Nordmark and posted to the IETF repository. Name: draft-nordmark-iotops-onboarding Revision: 00 Title: Different aspects of onboarding for IoT/Edge Devices Document date: 2021-07-26 Group: Individual Submission Pages: 8 URL: https://www.ietf.org/archive/id/draft-nordmark-iotops-onboarding-00.txt Status: https://datatracker.ietf.org/doc/draft-nordmark-iotops-onboarding/ Html: https://www.ietf.org/archive/id/draft-nordmark-iotops-onboarding-00.html Htmlized: https://datatracker.ietf.org/doc/html/draft-nordmark-iotops-onboarding Abstract: Previous onboarding discussions have focused on network onboarding. In this note we put that in the context of the larger onboarding picture to also discuss the onboarding to some management or orchestration system. The IETF Secretariat From nobody Mon Jul 26 19:03:07 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CE7D3A109B for ; Mon, 26 Jul 2021 19:03:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1tzoqUF12ryG for ; Mon, 26 Jul 2021 19:03:01 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9DB53A1078 for ; Mon, 26 Jul 2021 19:02:44 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 46617389B8; Mon, 26 Jul 2021 22:06:26 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id DrUOl_MDFSt2; Mon, 26 Jul 2021 22:06:22 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id B9FB2389B5; Mon, 26 Jul 2021 22:06:21 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id C4D951FB; Mon, 26 Jul 2021 22:02:37 -0400 (EDT) From: Michael Richardson To: hrpc@irtf.org, iotops@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Iotops] Authorization for IoT devices X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Jul 2021 02:03:06 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable HRPC folks, Today, I made a presentation at IOTOPS about https://datatracker.ietf.org/doc/draft-richardson-iotops-iot-iot/ I will send a youtube link as soon as it is published. The short is that I see a need to standardize the encoding of authorization control lists in IoT devices. It should be possible to determine who can open one's front door, (or furnace or stove or security cameras...), and also who can change the list. I think that it should be possible to have a third party (person, device, application) review the authorization list to see that, for instance, an ex-spouse does not have access. Or to allow a less technical person to easily effect that new policy. The access list might include a variety of other entities: banks with mortgages, sherrif, landlord, building manager. Some of these might be proclaimed by local law, convention, or contract. My goal isn't to say whether these are good or bad things, but rather to be able to clearly document them. I don't know if your furnace manufacturer should have remo= te access, but if they do, it should be explicit rather than implicitely built-in to firmware. I know that HRPC meets Tuesday, but I didn't ask for time because my week is already full. I'm asking that the RG might review the document, look at the use cases, and ideally: 1) suggest new ones 2) tell me why some of mine are silly 3) connect me with people who might be thinking about regulation in this = area. (The NYC key 2642/1620 situation begs for an auditable digital solution) While I wrote the document about front door locks, one should think that it applies to pretty much any major IoT device in the home. While some syste= ms have a controller or commissioner or "home base" that collects the keys to all other devices, in that case, who has the keys to his key holder? =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmD/aT0ACgkQgItw+93Q 3WVTMgf/XVBPjQCMWg0f/TA7luZtnsQvRipsnjQWnQvoaff8V1kvsPypcLLcZJNl mwNGcL2xWUoDWp4TggAr13QNzF8/wa/TQ72PCqHRwWLLzaavIELGtuOh1Re04Ml0 9nCNnPYfU19XkB+2njLPUctICEhvJob74S63DAKf4tcLCOrb/IYccuKdg9/rIBry aKjL0gS6hvYKTFyFw4J1YMbd8lHHxErxw/GyEVE+6QeDBBAb8qfqKaZ/jLB3Zx2l Yv+n0CgMLja7xpBmtgphvgu/jmqcGwB0Qte2dJ7G21zuKi3lu4RmBidsTVNq+ZdP bR0Uo4f/Am574GwWMh6IXu8ZWXINJg== =TeJD -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 27 03:00:57 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 620813A1DDF for ; Tue, 27 Jul 2021 03:00:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=LGwxCMv+; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=LGwxCMv+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fan30Q2DJ3lh for ; Tue, 27 Jul 2021 03:00:44 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00066.outbound.protection.outlook.com [40.107.0.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1304F3A1DF6 for ; Tue, 27 Jul 2021 03:00:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gZd+dPzCdh25mksHB5Po345RiMt7ulDKgifcAwbDy8=; b=LGwxCMv+ZPqKPLlXb/TBfPG1aOEdXq4eZpm4JH73sVxj4/Hx8l7jz56KOrfvEYSKTQ/UvCRsZolTkJJd8Thm8wGd6J44TMCkiFDZZ+YuvL/szJxUONntEWt6OQ0rrVRvlIfPLBh+colpqr30UIZyIGEeNUvjo9akdJceb2Q0kBg= Received: from AM5PR0701CA0064.eurprd07.prod.outlook.com (2603:10a6:203:2::26) by AM0PR08MB4372.eurprd08.prod.outlook.com (2603:10a6:208:144::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.24; Tue, 27 Jul 2021 10:00:41 +0000 Received: from VE1EUR03FT043.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:2:cafe::4c) by AM5PR0701CA0064.outlook.office365.com (2603:10a6:203:2::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.7 via Frontend Transport; Tue, 27 Jul 2021 10:00:41 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT043.mail.protection.outlook.com (10.152.19.122) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.24 via Frontend Transport; Tue, 27 Jul 2021 10:00:41 +0000 Received: ("Tessian outbound 1e4fcc40c873:v100"); Tue, 27 Jul 2021 10:00:40 +0000 X-CR-MTA-TID: 64aa7808 Received: from e7ced190da3d.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 5B38A6A0-BA14-42C9-B03A-302395E3EC72.1; Tue, 27 Jul 2021 10:00:34 +0000 Received: from EUR02-AM5-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id e7ced190da3d.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 27 Jul 2021 10:00:34 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EkO1lTymScxrN7AaRzCbl5D0/BJ0hHKahUGSvT1DQMbabcDul0oAxZpacvVjDB6UoTvEtgX2+EqTYoTg7EG+0G187l61UtQ8L3q6t/dw982XddaAaLWj2BgoQ+/V+ylSxDZ1dr48rBTlchqbj7I5cBM34VlUdiCkR2uU9R5rIObEXX99C5IhmpBnvk9rWONt7glJy/wn4mex19z/N7DPzO44UQ7bB9WI8O3+E2tMKR2g6pBMAedNjdSYSiFMJ3LKq9OvWmtcn0U4AOZl+iGo4phzFj5jOomuZDUYf3IFNd1k9nc5MDTqQCJgZvZ5R8jDVb4BZXy6HR4oUoqADwqCow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gZd+dPzCdh25mksHB5Po345RiMt7ulDKgifcAwbDy8=; b=D33pcvb/r/yXhnZEU1r5yisbgYpjbblfWtjogEaqKYrBMJzNn+GNnsyE3bSlKjWaMFvb26CITkyINk1N0GS88Ky9j3R4awvDi/D9S1CMpCpdnIyOXiYc7jsKPfmYiJ2qPOwg0fgAMtMKwEcP/277VwYQNuLQWfwX6Bumtge1bZ5c2P1sE7HhxXtNuQwVeCD7oWV5VZ7UVhyR3ohenDFOZbKheDN12xKuNFqIPcZZJwDpvxenzgMVzdpKkY/lkju7oXeKG/YsJUBYBaU7jFvNeagLRSaZO3Phf3uxBRomAKYr3cHc4hIqRonY8U0uRDTCzKPPnx1X0tJjqE0ViNjJrQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gZd+dPzCdh25mksHB5Po345RiMt7ulDKgifcAwbDy8=; b=LGwxCMv+ZPqKPLlXb/TBfPG1aOEdXq4eZpm4JH73sVxj4/Hx8l7jz56KOrfvEYSKTQ/UvCRsZolTkJJd8Thm8wGd6J44TMCkiFDZZ+YuvL/szJxUONntEWt6OQ0rrVRvlIfPLBh+colpqr30UIZyIGEeNUvjo9akdJceb2Q0kBg= Received: from DBBPR08MB5915.eurprd08.prod.outlook.com (2603:10a6:10:20d::17) by DBBPR08MB6187.eurprd08.prod.outlook.com (2603:10a6:10:209::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.25; Tue, 27 Jul 2021 10:00:32 +0000 Received: from DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518]) by DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518%3]) with mapi id 15.20.4352.032; Tue, 27 Jul 2021 10:00:32 +0000 From: Hannes Tschofenig To: Michael Richardson , "hrpc@irtf.org" , "iotops@ietf.org" Thread-Topic: [Iotops] Authorization for IoT devices Thread-Index: AQHXgouVFWMKuox4kUWxdOEjkHQAe6tWlvdQ Date: Tue, 27 Jul 2021 10:00:32 +0000 Message-ID: References: <18201.1627351357@localhost> In-Reply-To: <18201.1627351357@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 1E3532339E500D468FF8DAF241944552.0 x-checkrecipientchecked: true Authentication-Results-Original: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com; x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: cf55fb7b-ff2a-4ac4-b997-08d950e5645d x-ms-traffictypediagnostic: DBBPR08MB6187:|AM0PR08MB4372: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:7691;OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: k1xw7ZSBpWM66wyfki765BdFuqPjrwte+5BDUvgW7OSk3/rHwTAwbU4F06FM5uboyXw75ttLazxc98ceuf5CjTxvUxGTLMBOsL13IYsy6RnGrF5yYVnAN8U6jRieEe920M64R6YYZZtDli2XBC9g+VHYmISvJX2BqMS7YFPLT4xKcgYNDStqaYO8thwWzfurwa6AY5syRrUZXsnFJHaGMxETIrjEjt/oczcgDqMANTgDB/mAI3X8u/Q6cgQLkUl71PHJSy9QGGFbEXsYX6EWbeyA+MWTQ2SM2XpGYUWyaeuofSc4gCqGiYCwTHLPaPZ5mXLEYsJdDHeCS39ljtHWZo5YmhuIV2Li04XS42anzW+CJn0ljnhKy8wu0qZoc+fRhxle727sIJBORu7wNMjR4QzY7SLNNzayS96msoJd2fEoWvH50OpaU6p30tuewZYX/5jfOEMZH5iJCU4G2edZpcWCKk+Bh8IHBjB56GJFTh9dPfLPsliO6r9j0zR4UyQYj4fgjFy9qzncMEDAR+T8NFwdHMiexmtg4XZ08bl/EOoxqWEOAPPvAOxJtXzp5GYntnTV9VBOEHA6NZGQOa9nKP7l6hxuPBMdNWoWKaHh/66ueqa4KlEbp97RAtYfehC12aOs1Lz9B3mACw67LPe495N/LcUNA2oK9h0rtXZkg0IBOuK10tiGP1hQPMJTINQBsMw0UF3eRC39liQDDE0EenNFrejpt5Cjg38K9NTND/iWVNpDl9jDJsDHHczosG6qhGolvQ72m2vsPKo/WyruKI12tJMRXdl2vXtLh3F84vI= X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5915.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(39850400004)(346002)(136003)(396003)(366004)(86362001)(33656002)(966005)(122000001)(478600001)(38100700002)(83380400001)(71200400001)(2906002)(66574015)(8676002)(8936002)(52536014)(26005)(66446008)(66556008)(76116006)(66946007)(110136005)(64756008)(66476007)(316002)(9686003)(55016002)(53546011)(6506007)(186003)(7696005)(5660300002)(38070700004); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?dnFkU3NyRzVyeUpvSlArUFZjWUJmTCtLVm9kRXhlcGFST2cxaEJiejdkR1lx?= =?utf-8?B?OTBDTXJ5eVFUTWlhZzd1dzBlUzMrZnRUdjM1YVF3aHdMaG8vM2ZYcFFQY2My?= =?utf-8?B?eGkxRld6ckIyUHJOdis0OHI2a3c5SWdVZWU1SnVHMk9odFhQZWhTRk01Q3Zn?= =?utf-8?B?cStxdmQzYnZaV2UyZ3NmTG45MUV0WEcyQ21lLzM3Zlp6amQ0WHRrdHFrZFgw?= =?utf-8?B?d3MwRkN5b2ZFU2dHcXU1d0Ivc092VDdIYm04SC9sbWo2V1A0K21PejRRNWM5?= =?utf-8?B?S08zY3pPd2x4bE5PMGdXL2tDZi80WVdoL2I3SUoxRGlsVWZaWFBiZmlQK0hL?= =?utf-8?B?em1wclJYekRRejhVNGNuUUxSZGlDUlJoMmhDUzJUTXFBQVRSQ21Ram9sYzRa?= =?utf-8?B?OWppNlVqZzlwdWx2cHdlR3haTStxbTRlT1B1clZ4dzNPRzh5K3Z2WmsyN0lN?= =?utf-8?B?L3lXMWxnRTQxK2VkZTYvZnFQbVB1VFRnN20vWGxndXdZVGtPZ3hKb0syVkhp?= =?utf-8?B?cWc0aUVGT3NNQmxMT2daUlF0b0xKalRFckxGMndvV05GNDMvTDU5a1J2dGM4?= =?utf-8?B?TnEwa1NBU1dBdnFkUG84N3dTVXZiVEpqMkhZWmhWVWRaUGdxS0VkSVR5SCsr?= =?utf-8?B?dFIwZEdYdTlqaHYvV1piTUxTcmpWblZoWVU0ZXpGajAwcnVxeWJybWtMR0dn?= =?utf-8?B?Q2paVjRxZ2ZId0F2Q09RTkZnV3B5YW9ma0xPK1BOMkZUcDhwTVBuUVk0WU9t?= =?utf-8?B?TmRWUlNLdXRZTEpWSUQ3c1BYemNTQi93dmlLVndoSnhiMDZ4bUl2QmFIMnEv?= =?utf-8?B?Wll4cXU2dGp1dTBnNm5IUE1TSUc2UTlxcTR5QTFSWnVoTjc5a09YZG1PTDRN?= =?utf-8?B?VktqSGFHZzBsU3E1eTFBdUI3d2ZzbXduRkV0d0cxemtIMnB3QkErSnJuc0RR?= =?utf-8?B?bkRGcXVjWnFwZWxpZDdoVTU2eno2bWtkQjdxYW1xbGk1QnBPSHhYVWMzZWE0?= =?utf-8?B?RnB0THRrNDVHdkp4UEdTcEM2cnh1ZnFHOVJnVnAyTXBuU2VxRThsMCtXczE0?= =?utf-8?B?SlN2OUdJQmpRU0VWZ1lkNDZ5RlBaL04vUjNXTTlHbitqT1ppeXhQZElqMXI5?= =?utf-8?B?SWdQMVRMYW9YNmUrdUlyT2pUdm8yUkVnYUJMakxlOUIzTXNRZHNiUnBqOXJj?= =?utf-8?B?cFo3RDhpd1JWTEZpL2ZRWVU4eUR2MUdPZGZDcjhnN2xHeGJ0OGdKZWE0L0Y5?= =?utf-8?B?ak9tNktSdWRaSWx2Sm4wWmNTQWJyNUkzZDVZL05iNW5sUXdvY3RSQnNaTENH?= =?utf-8?B?WVNoZEN0V0dOL2lxdHZ6SGtvYlFOZytMZUYvRDlObjZIN1JTVVQza3RhaFlq?= =?utf-8?B?VFY3eXRVTndXMk9kdjVQODJzRVlMN3VGd2d0am1lRzlQU2I5aGd1eER4QXV6?= =?utf-8?B?b0ZNRmt4K1F4NHJzUWlJRHRkQ2ducmtmZGcvbkJMcEFubnJ0MWNVL0tQK2Zu?= =?utf-8?B?Q0xtWW5ZekFlczVyRFJnenM1MWc5UzZxaHcxV3BONTlsakZER091M2RxMVFn?= =?utf-8?B?RXNpQjdLYklMcVNaSzFxQVBLazYvOXh4TUZzak1TWXlDQXJaK2J6Y2pLYzha?= =?utf-8?B?cmhlWUwxdlpEV0puczVUWmdHR3Vwb25VdFgrRms1b0JXTzI1R0N4RmdjakpO?= =?utf-8?B?bDJhRUw2cS9iWVBldzIxRjNPUkEzSVYxQjBHcUpuVyt1NjBONVhIakZpelhG?= =?utf-8?Q?uYB+jIFfUFUcPm1il0=3D?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6187 Original-Authentication-Results: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT043.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: d3deebd2-9966-4d24-faf5-08d950e55f7d X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: VozbZCjv3fanKhI6byJ8Y6jYAmusH/5MTrVWJubAnM98WA7TttD66LpKmNG3K3O3aaeCmsYxvIUa9mzas3LzbqXm5M54n8Vu7KMy0sBYnJYm43aI2rRarB0tqRLn+epl3A6ePFR6M1wBLjuj35RVIki55927zuc5j3Pp0ON4RX09lDp6mD+tMIkhX8hsNY6S9Z9GcxLSL+lX1wLxv0vROwX3CFbLHQb9Nxg2HtBnHypu4Q+FCuaJZLw8IBqevh9NsM7qrHIctIfgYaW9hg0j1HPbplOFFzzDVoIG48JI5ylKYItNVsoEuYprWVo8UKeMaAYFKlYbGzeDMSgWd3VrV5pZwh9V+6cveQdMENWDL+sFFxEyq7zmOihPk3mKSj7yHd3MFeDih/Nase3GIGNA2+eMIfOTLnR4/GXuQGRjYUOrgzRsAWkY+VdjizsDNNr86/fContDJ2ATMKp4Y0TFna+rFJBISyh1v6Ay7dFNT0KvMCLfWFZS0QQmCgALmOM+LZ+hGoSBCh/tZZBtr9Aclz6PxmJCNdOv1tnq8jo6djkvwKuPjkTU81SGLqItF2AKjKqxyeLu284lVbSznufDxmXrHXJjJLcV6EpQgZ8g0wLeaLdm1RE97LxCEsGAropNmi1OKMSvEXd2Ow3SjuvYWCZuSfjPSYigIeZt/dErNdvZcvd3BsCe3XTS7B1DkVZjd9IXTltQp+9aF+J6yzZh2VloL41E2RpJxZIkDfaxKGgNnC/fokBV8IED0I+SCw0tiAZ5m5otPg+wFHG464XlSA== X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(46966006)(36840700001)(356005)(55016002)(8676002)(8936002)(86362001)(82310400003)(33656002)(66574015)(9686003)(966005)(70586007)(83380400001)(110136005)(52536014)(6506007)(53546011)(186003)(336012)(508600001)(36860700001)(81166007)(70206006)(26005)(2906002)(316002)(47076005)(7696005)(5660300002); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2021 10:00:41.0103 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cf55fb7b-ff2a-4ac4-b997-08d950e5645d X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: VE1EUR03FT043.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB4372 Archived-At: Subject: Re: [Iotops] Authorization for IoT devices X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Jul 2021 10:00:55 -0000 SGF2ZSB5b3UgdHJpZWQgdG8gdXNlIEFDRS1PQXV0aCwgTWljaGFlbD8NCg0KVGhlIHdvcmsgaW4g dGhlIEFDRSBncm91cCBoYWQgdGhlIGdvYWwgdG8gZGV2ZWxvcCBhbiBhdXRob3JpemF0aW9uIHNv bHV0aW9uIGZvciBJb1QgZGV2aWNlcy4NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZy b206IElvdG9wcyA8aW90b3BzLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBNaWNoYWVs IFJpY2hhcmRzb24NClNlbnQ6IFR1ZXNkYXksIEp1bHkgMjcsIDIwMjEgNDowMyBBTQ0KVG86IGhy cGNAaXJ0Zi5vcmc7IGlvdG9wc0BpZXRmLm9yZw0KU3ViamVjdDogW0lvdG9wc10gQXV0aG9yaXph dGlvbiBmb3IgSW9UIGRldmljZXMNCg0KDQpIUlBDIGZvbGtzLA0KDQpUb2RheSwgSSBtYWRlIGEg cHJlc2VudGF0aW9uIGF0IElPVE9QUyBhYm91dA0KICAgICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2RyYWZ0LXJpY2hhcmRzb24taW90b3BzLWlvdC1pb3QvDQpJIHdpbGwgc2Vu ZCBhIHlvdXR1YmUgbGluayBhcyBzb29uIGFzIGl0IGlzIHB1Ymxpc2hlZC4NCg0KVGhlIHNob3J0 IGlzIHRoYXQgSSBzZWUgYSBuZWVkIHRvIHN0YW5kYXJkaXplIHRoZSBlbmNvZGluZyBvZiBhdXRo b3JpemF0aW9uDQpjb250cm9sIGxpc3RzIGluIElvVCBkZXZpY2VzLiAgIEl0IHNob3VsZCBiZSBw b3NzaWJsZSB0byBkZXRlcm1pbmUgd2hvIGNhbg0Kb3BlbiBvbmUncyBmcm9udCBkb29yLCAob3Ig ZnVybmFjZSBvciBzdG92ZSBvciBzZWN1cml0eSBjYW1lcmFzLi4uKSwgYW5kIGFsc28gd2hvIGNh biBjaGFuZ2UgdGhlIGxpc3QuDQoNCkkgdGhpbmsgdGhhdCBpdCBzaG91bGQgYmUgcG9zc2libGUg dG8gaGF2ZSBhIHRoaXJkIHBhcnR5IChwZXJzb24sIGRldmljZSwNCmFwcGxpY2F0aW9uKSByZXZp ZXcgdGhlIGF1dGhvcml6YXRpb24gbGlzdCB0byBzZWUgdGhhdCwgZm9yIGluc3RhbmNlLCBhbiBl eC1zcG91c2UgZG9lcyBub3QgaGF2ZSBhY2Nlc3MuICBPciB0byBhbGxvdyBhIGxlc3MgdGVjaG5p Y2FsIHBlcnNvbiB0byBlYXNpbHkgZWZmZWN0IHRoYXQgbmV3IHBvbGljeS4NCg0KVGhlIGFjY2Vz cyBsaXN0IG1pZ2h0IGluY2x1ZGUgYSB2YXJpZXR5IG9mIG90aGVyIGVudGl0aWVzOiBiYW5rcyB3 aXRoIG1vcnRnYWdlcywgc2hlcnJpZiwgbGFuZGxvcmQsIGJ1aWxkaW5nIG1hbmFnZXIuICBTb21l IG9mIHRoZXNlIG1pZ2h0IGJlDQpwcm9jbGFpbWVkIGJ5IGxvY2FsIGxhdywgY29udmVudGlvbiwg b3IgY29udHJhY3QuICAgTXkgZ29hbCBpc24ndCB0byBzYXkNCndoZXRoZXIgdGhlc2UgYXJlIGdv b2Qgb3IgYmFkIHRoaW5ncywgYnV0IHJhdGhlciB0byBiZSBhYmxlIHRvIGNsZWFybHkNCmRvY3Vt ZW50IHRoZW0uICAgSSBkb24ndCBrbm93IGlmIHlvdXIgZnVybmFjZSBtYW51ZmFjdHVyZXIgc2hv dWxkIGhhdmUgcmVtb3RlDQphY2Nlc3MsIGJ1dCBpZiB0aGV5IGRvLCBpdCBzaG91bGQgYmUgZXhw bGljaXQgcmF0aGVyIHRoYW4gaW1wbGljaXRlbHkgYnVpbHQtaW4gdG8gZmlybXdhcmUuDQoNCkkg a25vdyB0aGF0IEhSUEMgbWVldHMgVHVlc2RheSwgYnV0IEkgZGlkbid0IGFzayBmb3IgdGltZSBi ZWNhdXNlIG15IHdlZWsgaXMgYWxyZWFkeSBmdWxsLiAgSSdtIGFza2luZyB0aGF0IHRoZSBSRyBt aWdodCByZXZpZXcgdGhlIGRvY3VtZW50LCBsb29rIGF0IHRoZSB1c2UgY2FzZXMsIGFuZCBpZGVh bGx5Og0KICAxKSBzdWdnZXN0IG5ldyBvbmVzDQogIDIpIHRlbGwgbWUgd2h5IHNvbWUgb2YgbWlu ZSBhcmUgc2lsbHkNCiAgMykgY29ubmVjdCBtZSB3aXRoIHBlb3BsZSB3aG8gbWlnaHQgYmUgdGhp bmtpbmcgYWJvdXQgcmVndWxhdGlvbiBpbiB0aGlzIGFyZWEuDQoNCihUaGUgTllDIGtleSAyNjQy LzE2MjAgc2l0dWF0aW9uIGJlZ3MgZm9yIGFuIGF1ZGl0YWJsZSBkaWdpdGFsIHNvbHV0aW9uKQ0K DQpXaGlsZSBJIHdyb3RlIHRoZSBkb2N1bWVudCBhYm91dCBmcm9udCBkb29yIGxvY2tzLCBvbmUg c2hvdWxkIHRoaW5rIHRoYXQgaXQNCmFwcGxpZXMgdG8gcHJldHR5IG11Y2ggYW55IG1ham9yIElv VCBkZXZpY2UgaW4gdGhlIGhvbWUuICAgV2hpbGUgc29tZSBzeXN0ZW1zDQpoYXZlIGEgY29udHJv bGxlciBvciBjb21taXNzaW9uZXIgb3IgImhvbWUgYmFzZSIgdGhhdCBjb2xsZWN0cyB0aGUga2V5 cyB0byBhbGwgb3RoZXIgZGV2aWNlcywgaW4gdGhhdCBjYXNlLCB3aG8gaGFzIHRoZSBrZXlzIHRv IGhpcyBrZXkgaG9sZGVyPw0KDQotLQ0KTWljaGFlbCBSaWNoYXJkc29uIDxtY3IrSUVURkBzYW5k ZWxtYW4uY2E+ICAgLiBvIE8gKCBJUHY2IEnDuFQgY29uc3VsdGluZyApDQogICAgICAgICAgIFNh bmRlbG1hbiBTb2Z0d2FyZSBXb3JrcyBJbmMsIE90dGF3YSBhbmQgV29ybGR3aWRlDQoNCg0KDQoN CklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0 YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYg eW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2Vu ZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBv dGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhl IGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== From nobody Tue Jul 27 03:20:50 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92E663A1E8D for ; Tue, 27 Jul 2021 03:20:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Srq3DNsg; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Srq3DNsg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tjPPEr_2YIB0 for ; Tue, 27 Jul 2021 03:20:42 -0700 (PDT) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2087.outbound.protection.outlook.com [40.107.22.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 722B63A1E89 for ; Tue, 27 Jul 2021 03:20:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2fxAxUXno06fVcXYRq1qI2AfNXyn1+HQVSgGPaI7VEM=; b=Srq3DNsgHWVsprxxLVrEMEy10yVeRZW8cUbufHdRTyHen5qJULR+Ajr2dwyytrXMADC+dI/XYsbCA4R2pJxULUIH82C1+XltWf9kG0l32N0YMh/ZXDWf7usUkOdFmC89VM15eU+AGWryxRd7Wq/6iwaeORY+dRCciChGyFRWqz8= Received: from AM6P192CA0061.EURP192.PROD.OUTLOOK.COM (2603:10a6:209:82::38) by HE1PR0801MB2076.eurprd08.prod.outlook.com (2603:10a6:3:4c::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.29; Tue, 27 Jul 2021 10:20:39 +0000 Received: from AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:82:cafe::14) by AM6P192CA0061.outlook.office365.com (2603:10a6:209:82::38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18 via Frontend Transport; Tue, 27 Jul 2021 10:20:39 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT062.mail.protection.outlook.com (10.152.17.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.24 via Frontend Transport; Tue, 27 Jul 2021 10:20:37 +0000 Received: ("Tessian outbound 4c02392472aa:v100"); Tue, 27 Jul 2021 10:20:37 +0000 X-CR-MTA-TID: 64aa7808 Received: from ac45c1c0c8ba.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 917598F6-F949-4361-A34E-F822F8E9B56F.1; Tue, 27 Jul 2021 10:20:31 +0000 Received: from EUR05-DB8-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id ac45c1c0c8ba.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 27 Jul 2021 10:20:31 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Q9q4eOGfYtwTo/Q6x8dchcoyiA6pi0ei/afzIg1WMpL0wf/ilHhC6PhHkGgphHnGfq6PjdrfCKgUShQz2D0Plr/K8HixM/BUG3SaOlEH7RgVA2RdaeioUtTH+6S19N+rGvtFvVcpkb7w/4p1qP/WJj3fo8Tp7VkBXoZFESOOJdzNd62xeA2V/7CLW47fpX1BQJHuTupqKKPwU3dTteSUtM9eOl+rBolp5lBb6fbrcGd30AemlyaCfkkz9nmcaOYsKNUAPUYBIrBXHEqETkhvPdWU1YeINbX21xKzZVOAdXdUYap7NJx0wrgO6m9PagQjM/sgBdMgyzw5UnzSCp4rQw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2fxAxUXno06fVcXYRq1qI2AfNXyn1+HQVSgGPaI7VEM=; b=apfkjWim7MRjMO01xmb+5qEcf0QRgIzpMf4V7GqCxJH55lOxOQe/7RtYAEiJGWqd5L/MsLGBSJLrejHTEIsLI17SN2QzUB6SjRjGuNL/uJ0Fiudg1snpSB0KnJVE2EIEuUoXiSuuRpODQYNTzh0EKzh7GDmDA0+eFf+8mxbAKHEwMAAEpjoxXroo0/PcjN5kEl2+ePLwb26w7/bk7AScwGgx+KGQgg38qIhkbxSsXxvhzenzbZ08LxXU+oAbePyYt0q7gb8NKrI3A2ej8bafTnoI2TBtu6dF1LKtA8oyXRPeZ1AyTLRq1Y5JyZOeMAVyUPy9td+EMUZ8mmep2Wqu3Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2fxAxUXno06fVcXYRq1qI2AfNXyn1+HQVSgGPaI7VEM=; b=Srq3DNsgHWVsprxxLVrEMEy10yVeRZW8cUbufHdRTyHen5qJULR+Ajr2dwyytrXMADC+dI/XYsbCA4R2pJxULUIH82C1+XltWf9kG0l32N0YMh/ZXDWf7usUkOdFmC89VM15eU+AGWryxRd7Wq/6iwaeORY+dRCciChGyFRWqz8= Received: from DBBPR08MB5915.eurprd08.prod.outlook.com (2603:10a6:10:20d::17) by DB8PR08MB5289.eurprd08.prod.outlook.com (2603:10a6:10:b2::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.29; Tue, 27 Jul 2021 10:20:28 +0000 Received: from DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518]) by DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518%3]) with mapi id 15.20.4352.032; Tue, 27 Jul 2021 10:20:28 +0000 From: Hannes Tschofenig To: Erik Nordmark , "iotops@ietf.org" Thread-Topic: [Iotops] Fwd: New Version Notification for draft-nordmark-iotops-onboarding-00.txt Thread-Index: AQHXgmofMOGEZUz2AkS88a3PRyh1+atWm1tA Date: Tue, 27 Jul 2021 10:20:28 +0000 Message-ID: References: <162733690703.2852.10131076597579602787@ietfa.amsl.com> <1456b8bd-dd21-8e13-1f62-ac36a24a786b@acm.org> In-Reply-To: <1456b8bd-dd21-8e13-1f62-ac36a24a786b@acm.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 0969C639367E044A8FECF7B5742DC70C.0 x-checkrecipientchecked: true Authentication-Results-Original: acm.org; dkim=none (message not signed) header.d=none;acm.org; dmarc=none action=none header.from=arm.com; x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 4185ebb4-e822-4327-2993-08d950e82d65 x-ms-traffictypediagnostic: DB8PR08MB5289:|HE1PR0801MB2076: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:6790;OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: we0B2rqI91f72r3T/ahJ5CpAF8Q58OHvdcjLf2680/Rhkw5bZ2CMUImzRad3/7zvMGfkPOJOt4qzYEx5o4Il9/k0MXx/pMbUCAXYG0hMnFjehRCrgjphPkWjKBCrON8gxsWxdyjEVlyoEeFS8kgkQ+arwcCym9eOIBs0MaliW+2628WhiSyHyYPkVfAzPI4TL9UzszqBqh4GOd67PCH4Zok0TuctEeXxwvESp5NEXaJwXIKB8bSwkp6iNuBeuG3sFhsjkXIhLc1bxG0plxMSaZXLru6iKGaRAWTlCBQoVYCljLlM3lqb1tJzXh6iFGRCsGOr24X10YyBmsd7Pz4ypss8Tn5PHfXAHWNGZACGNuv+hXy4M2+4I0tVVAvQBsUS81Wr5BFKmdC7lKw+AEHKVx3nlik0tEP456VYiYezvmgI6wm6N+qnQrvep6LaPESGE+6mO+pEnZ+L+1dznQcwRT6Szcy/hKKdndKL+eCWiOTiXy0LzY4HsyGHTi0Xe6pm2ekPLrTlm/JO120re/IdV51QkxSqn8LnycP7S8o49DpjwNVtLbB/x3Dj3XpgfoSXCGNNF1odEPnyrCScnse0tGmRWv5jTTCqqxpoCCuXbiuZYDcL3KWfkX7Ynbpywn32iLArRRj4LYrwDJf9gqlet4oxZDY3vnQndINZ06++kaPIDgh+rwF8vywHphPh+RVnA4ZDIsmbb2KdIQSNaRxf0CihbFbat/+TyNryOcacRntxddCE06vjkBym6d3WcfLDOjtM4/GbLT7IxlNhJMfI9cx82oXXxbIoDewkb2nHpWtqSPhCW+AdpknD7prHqmQjkMgsvQ38xphdliIQEMMqbQ== X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5915.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(346002)(396003)(136003)(39850400004)(366004)(71200400001)(53546011)(38100700002)(15650500001)(83380400001)(966005)(66556008)(66946007)(66476007)(5660300002)(2906002)(6506007)(55016002)(64756008)(186003)(33656002)(86362001)(316002)(110136005)(26005)(9686003)(478600001)(7696005)(66446008)(66574015)(76116006)(122000001)(8676002)(52536014)(8936002)(38070700004); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?mULS5y/ivu2/ifBlzFHXl/wwcmZjCm883ijcqB6JY4EmWjbcte8Um776BBgY?= =?us-ascii?Q?+lBHuKC4u7mlAimfhB36y92g1B6WVfLtrXHHVSHIeCLtS5iEvzUvKwgsgP/H?= =?us-ascii?Q?e6vNWeYzK1MxiTh/lQJdtXsjU9clQRBTruPPBiA6HXPyxnB8oa1h5Xo2ssY/?= =?us-ascii?Q?KBxjfeG1FvcWiMOMNdw30OS/Zs7tT8MmeJkw52W7yljGsQF2yaGmi+CzpaN7?= =?us-ascii?Q?d6Nd5wNjbhLjntd1XL3VJsKXJelSLTkNSMEqLqhl/LbmYcAsyCg+QSz/RTIj?= =?us-ascii?Q?d68I7+T24LPGCSn0eXHYZsXWAaWE2wnAajsUBZ3MgEmXRCIMOr4+YTuSn6Co?= =?us-ascii?Q?eDbyNE1c1RlZ5SKdlTggUTu9QjeO1G7WDKcvtstrJbXDFKaUY/ckk9T6Dy1m?= =?us-ascii?Q?t2CaM+hTTD5ORfhS/VoH/M+Dyc1NBZlffy1Wkye/H/eUgEnr/l0JV27rALjN?= =?us-ascii?Q?3jBJguj3yDJxJlqrR4ut0YLKDapjLcPmki85ds/gLnKRW+QvDFq73zIwA3xd?= =?us-ascii?Q?okv36hfgxMJYf3nILKEctWYyvlypTUg+5ewpkVxObzgicySFqGtShgqg4YvV?= =?us-ascii?Q?cHgUo84P3qg2PbTkf9DHe1uPsI5SAC6hNqED/u7vGJTYnU8YkBjANxmOCzgs?= =?us-ascii?Q?RuG6SIK+gFYcXyr6mKbKZgYeBK54DG44XKD48Bm5Wse/NaWXyEkg1foKpk74?= =?us-ascii?Q?BydeYbKaxhbdO+1RO7aVLRMAIzhh15PXhdPUvCyzphoeyuQAegp3YH1veP6f?= =?us-ascii?Q?KYT0IvLxXrHVkBJG2xhqZ7yK4z/e8wMO9CEKXAEFcbJ5sAWEIEoUVj23+Ibw?= =?us-ascii?Q?DSQ2zm7r+pxpbppFIgWok5aRLmkaTc7u/8row1/ZWnuFfGrIn6cfnatVjPZb?= =?us-ascii?Q?0H1GNb01cmYhDHAKTxzO3mclkouYAvXxZblAkb9oj5Esxoyp+wuamCiDQvjl?= =?us-ascii?Q?VwDKlMeIITAmeHpSbqj6lodPx/LLym/Muhhl8ZuKy8wdKJqz9ng/rCRvqrhG?= =?us-ascii?Q?AOx9KOl9IEcuWbblGp37x0YxWtrpfMSIBQ8ugd4P6zrT07iNfqm7mjD7mxAF?= =?us-ascii?Q?/9Z0OYzzInI52tVmJcoC3ZVkUmEvvMuoxSJ0052bTeTobkTDXfu07yNaRxH5?= =?us-ascii?Q?Nj9Wj7QcADQHOju4TfBwwt9yjxKT8vzdxcQBeaCVCzlFQVNLwByqxpDdF/ek?= =?us-ascii?Q?wj4nCFgqy/JA+9L/POKrZvOwlAPw9iQ96gKKm3fG9n4zIK0O5FngaGvKYrf+?= =?us-ascii?Q?j1r2w2l4kNKRC2ZSGqHQCjm93r5dh6ScuGEKLM6S1BF7REsipm2zYKzFQLgl?= =?us-ascii?Q?lduVbkLFQ1vuDC+Gdb9iLbju?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB5289 Original-Authentication-Results: acm.org; dkim=none (message not signed) header.d=none;acm.org; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: 3a31e86e-57f2-44dc-88ad-08d950e82853 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: ZAtKUgD2LhTGEAIiF1/dx5e3Zu7nEdzdX6yX40msY3WIaQfS8pC2oOUw25X6mmWye5BJm17X8kAq2wZgN/ky+HY0HF7EKEOXbJH7d+KRHOtFHA0qWJj9zF7t8s77oepWJ+Id8qp4pJ+sZLVpkSYVCYBsi2Ici3A+cBvK0IupndSojmHw1Q2YQ1+UtjF/JmdOACy7lGHcyKjHV5MpWEdrl089o4jfJLGt+xgIUieIxEyqPu/P1ADEDUX5mfjWFNvZUVSWrE4Y14Q7Qrho5TfmqGBPhA58CfqtFJkL4DXnT0kBUy+RcGBWw2dA9S+IO7glt6OVaCXtjtyh25ADvly9wm6Boke5PvF0CIcPDbjq3oq0cmsQr6LpDvXsJo0g8zUFI66mCOAAiaqlPZ/rrHDBI2T5ZNSZzHp8KkvrmVZ3K52k0XI2gxw/jILs/YSGFF4DoeSustcIzo2qX9ulDqKXakF9TbzZmW1CQ565AR5ABhXoOgH4V4rPWJOeW0NIPuTdcrSV9Be3dGhXQ355lNjDm11OAySr4byafJmfT/xdyLypZDGLDKTTip8aUL9Au7anZc4Mf13fKpSw9Ooa9uMQaTa3O3rT0kP8mmS6vlN8MsPAuKJvdprjYCZjpFY1dN+RMw61MpJhHVCrBSRMjBeNHUilQs9/s1OFFkiiHkM+8XNHWZkHqtKhvx2ahyWbpN7O1IbK8iMd7wOXoa48SgBvGY1Ndw20N6Rc8X3dAyL8aOX9IlibmJcd8NQDDavreVhlEvT75CeCwFirNtg5oDvXhMW808y65YqnnW/QHUA56TuhxJPxG8GJHjfJVxPTe85z X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(36840700001)(46966006)(36860700001)(6506007)(26005)(2906002)(83380400001)(55016002)(66574015)(356005)(7696005)(53546011)(81166007)(5660300002)(508600001)(8936002)(966005)(9686003)(86362001)(47076005)(8676002)(186003)(15650500001)(52536014)(33656002)(316002)(70586007)(110136005)(82310400003)(70206006)(336012); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2021 10:20:37.3325 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4185ebb4-e822-4327-2993-08d950e82d65 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB2076 Archived-At: Subject: Re: [Iotops] Fwd: New Version Notification for draft-nordmark-iotops-onboarding-00.txt X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Jul 2021 10:20:48 -0000 Thanks for sharing the draft and for your presentation yesterday. A short note: > Project EVE [eve] is an example of a secure but minimal approach to enabl= e secure onboarding, without having a hard dependency on manufacturers and = manufacturer certificates. > Imprint device which controller to trust (a root certificate) and initial= URL to contact Isn't the root certificate the manufacturer certificate? So far, only two approaches have been developed: (1) During manufacturing you provision keys into the device. Then, you use = those keys to create further keys when the device is put in use. FIDO Devic= e Onboard, LwM2M bootstrap, ANIMA, ... etc. fall into that category. (2) At first use you provision something into the device under the assumpti= on that an attacker is not around (for example based on proximity). For exa= mple, BLE uses this technique. Both approaches have pros and cons. I understand that people want the secur= ity benefits of (1) without the drawbacks of (2). I just have not seen that= solution yet. Ciao Hannes -----Original Message----- From: Iotops On Behalf Of Erik Nordmark Sent: Tuesday, July 27, 2021 12:03 AM To: iotops@ietf.org Subject: [Iotops] Fwd: New Version Notification for draft-nordmark-iotops-o= nboarding-00.txt -------- Forwarded Message -------- Subject: New Version Notification for draft-nordmark-iotops-onboarding-00.txt Date: Mon, 26 Jul 2021 15:01:47 -0700 From: internet-drafts@ietf.org To: Erik Nordmark A new version of I-D, draft-nordmark-iotops-onboarding-00.txt has been successfully submitted by Erik Nordmark and posted to the IETF repository. Name: draft-nordmark-iotops-onboarding Revision: 00 Title: Different aspects of onboarding for IoT/Edge Devices Document date: 2021-07-26 Group: Individual Submission Pages: 8 URL: https://www.ietf.org/archive/id/draft-nordmark-iotops-onboarding-00.txt Status: https://datatracker.ietf.org/doc/draft-nordmark-iotops-onboarding/ Html: https://www.ietf.org/archive/id/draft-nordmark-iotops-onboarding-00.html Htmlized: https://datatracker.ietf.org/doc/html/draft-nordmark-iotops-onboarding Abstract: Previous onboarding discussions have focused on network onboarding. In this note we put that in the context of the larger onboarding picture to also discuss the onboarding to some management or orchestration system. The IETF Secretariat -- Iotops mailing list Iotops@ietf.org https://www.ietf.org/mailman/listinfo/iotops IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Tue Jul 27 18:52:29 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A2A63A1604 for ; Tue, 27 Jul 2021 18:52:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 624hVx47f1GC for ; Tue, 27 Jul 2021 18:52:22 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7D373A1606 for ; Tue, 27 Jul 2021 18:52:22 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 2BF8A389A5; Tue, 27 Jul 2021 21:56:07 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id bbWrtc6vaYyT; Tue, 27 Jul 2021 21:56:04 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 2001F3897B; Tue, 27 Jul 2021 21:56:04 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 98F9D454; Tue, 27 Jul 2021 21:52:16 -0400 (EDT) From: Michael Richardson To: Hannes Tschofenig , "hrpc\@irtf.org" , "iotops\@ietf.org" In-Reply-To: References: <18201.1627351357@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] Authorization for IoT devices X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jul 2021 01:52:28 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hannes Tschofenig wrote: > Have you tried to use ACE-OAuth, Michael? My understanding is that it requires a AS to evaluate the request and the generate a ticket/token for the RS. 1) many people perceive the AS as being the cloud component and they don't want a cloud part. 2) but in any case, it's the form of the rules which the AS evaluates to make the authorization decision that I care about. AFAIK, neither OAUTH2 or ACE-OAUTH standardizes that (or intends to). > The work in the ACE group had the goal to develop an authorization > solution for IoT devices. If I'm wrong please correct me. How would ACE-OAuth identify the local Sheriff? =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmEAuFAACgkQgItw+93Q 3WXdqQf/fUFBS6bYNNYsVgzYd3qgMS7zCCe/XnD+Kb3mZfNLlDjLtOdGmrLnpC1V 92Fda8yIB5P6cPW+zOXylHSF1bgbg4GIR6dtrybkZpwHPSh+AjwvXNzDulKyw35f IJNaZ+XFiN4b+S9pc1AXLGZj+h3ih/Ruji0herXvG94D8jDom7gwmiJZfjkOTRy3 bJH2Gp5kvVfCl7BMgPUbKN/OA6XAr5D7VwK66l2OhvLu9BO4N/Ye71mIRA4vM58I 96sT5bD6G3nQwtu+T0r6V1l/APrt9tN/vNz+m54i2vpmxctsPd49HkF6hbkXAHs1 kPAoDpITJTgl+Vk+j/uPTsHKvEaduw== =aI06 -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 28 05:40:56 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 220C03A0D90 for ; Wed, 28 Jul 2021 05:40:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=AuhdgqAq; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=AuhdgqAq Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uQ9FcxSUZPW6 for ; Wed, 28 Jul 2021 05:40:47 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10068.outbound.protection.outlook.com [40.107.1.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C854D3A0D78 for ; Wed, 28 Jul 2021 05:40:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GNxiwRZqdYdiuxxLJHcCuucr9XaJenww6eIG97NACQU=; b=AuhdgqAq8VL1GI/F8TsWabWSOLsrlImGUs2WEk9t6eqmtO4oGq/OVBBtfCaC9rwPw1mLuBrUYk/um646Z6TfIkzSMqJFDDfeMxOnlXNS0TkU5PlrnNtl7gGMXp/Rqj+e3OIZHL+lwwVLgYDXvmet4HgsmwY0mXBcliy/SpEC0e8= Received: from AS8PR04CA0027.eurprd04.prod.outlook.com (2603:10a6:20b:310::32) by PAXPR08MB7278.eurprd08.prod.outlook.com (2603:10a6:102:215::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.25; Wed, 28 Jul 2021 12:40:39 +0000 Received: from AM5EUR03FT057.eop-EUR03.prod.protection.outlook.com (2603:10a6:20b:310:cafe::51) by AS8PR04CA0027.outlook.office365.com (2603:10a6:20b:310::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.20 via Frontend Transport; Wed, 28 Jul 2021 12:40:39 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT057.mail.protection.outlook.com (10.152.17.44) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.24 via Frontend Transport; Wed, 28 Jul 2021 12:40:39 +0000 Received: ("Tessian outbound cee5995f7b16:v100"); Wed, 28 Jul 2021 12:40:38 +0000 X-CR-MTA-TID: 64aa7808 Received: from fbd871ac84d1.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 65BF678F-D1BF-469D-B382-E4CA8D400533.1; Wed, 28 Jul 2021 12:40:32 +0000 Received: from EUR05-VI1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id fbd871ac84d1.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 28 Jul 2021 12:40:32 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HCBwHptpbN7/hnblGLkBzuTJBA4AnPVAINT+jUOj9q6xcIsv6EHks9wfAkHea1azyhsOQU+ZZkLy5ipAEdwvO0Jx5ku+jeJlluEpbbydCdSoDnpmDSXLuBYbybzEzsojxAkgStMRc/zv813Yend0s+j7HA0po+xTlFUy3xEuUv7Lw+v3PmQX08YD2clP7LpjeRQ1WAlDcZ5qBzolETQBHlVL/maLOSNRd9o3w9iOmbfqtxkQrMx9dPNPJPuBk3rGfO+0Az9930qpFg5INJNuqsepmQrWxE8xq9gK5kNtAkZNLtIoL6pAfcKk6u9WJNdO5570uP6LTBcb24z7GptTiw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GNxiwRZqdYdiuxxLJHcCuucr9XaJenww6eIG97NACQU=; b=hwGmUMGDCLTdkWtLqmHQLbVAGq9O1+5OoVDVfbgRgQVOZtoRpfRMIgMv0sAbtbC8T9M7v3Bp9ySHUI9HOM+CljtZo28yPUtWfc/sZ+YkxzavQ/yoQf8m1jHGZiDPg42RGlOHXAKq9gYvVlA2CLVUV8uO9UphSdY97FTF+TgEEUglZasFn91New7Hbjhhlz4c0/0xtA/BIlDEEtOTP2HFvOky94lzPTZAP+XNsgPpe6IXwTo+12/TUirnaj1vKwgPHIChbEnS5XOcInMn/6r8NJmXoffXT+sKHnPKTW3Ao8amkrV/pCmhTNlJ9gb5cIC9axBEJNi+rkOWdOmtHIbaKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GNxiwRZqdYdiuxxLJHcCuucr9XaJenww6eIG97NACQU=; b=AuhdgqAq8VL1GI/F8TsWabWSOLsrlImGUs2WEk9t6eqmtO4oGq/OVBBtfCaC9rwPw1mLuBrUYk/um646Z6TfIkzSMqJFDDfeMxOnlXNS0TkU5PlrnNtl7gGMXp/Rqj+e3OIZHL+lwwVLgYDXvmet4HgsmwY0mXBcliy/SpEC0e8= Received: from DBBPR08MB5915.eurprd08.prod.outlook.com (2603:10a6:10:20d::17) by DB8PR08MB5514.eurprd08.prod.outlook.com (2603:10a6:10:fa::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.25; Wed, 28 Jul 2021 12:40:24 +0000 Received: from DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518]) by DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518%3]) with mapi id 15.20.4373.018; Wed, 28 Jul 2021 12:40:24 +0000 From: Hannes Tschofenig To: Michael Richardson , "hrpc@irtf.org" , "iotops@ietf.org" Thread-Topic: [Iotops] Authorization for IoT devices Thread-Index: AQHXgouVFWMKuox4kUWxdOEjkHQAe6tWlvdQgAEKVACAALMi8A== Date: Wed, 28 Jul 2021 12:40:24 +0000 Message-ID: References: <18201.1627351357@localhost> <23319.1627437136@localhost> In-Reply-To: <23319.1627437136@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 381A9AA45E76294590231470CCC43E32.0 x-checkrecipientchecked: true Authentication-Results-Original: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com; x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: b2815440-8852-4bf2-74ff-08d951c4e7c1 x-ms-traffictypediagnostic: DB8PR08MB5514:|PAXPR08MB7278: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:6108;OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: SKUxVsAPnxuGDcNAu88wNhMGQ6pk08PcM9DAZhwEoc6VGZ/oBvy2TxHCnQekxJlidNk6Q10WQ/451u7yGEPNqf/g7DZsiMA+rpfTzEB4F+0R9JXnvyIZyoEaiq/NjxoCK2XtL2OleJx9U0z6IgB7VtT3QAyvRj5HggKbDM6FSH3tbpqWPR06Rl4ZLN/faRVbpWI80AoCLtCcqzFSCIAkb4MMv1itMmHLPNcilEfwBpSAMohqwRllAERIfnErpqVnaIjLEkqQvmGpHP+egmBrft0+JeQBJkem78SfoYVsqO93M98OpMifdBbwpK+OxpFF8QRgG4lhXPgMc2kOeQxjzh2+Q2Rvx0rd3yVdgbIfrxVQdApC+e5Qca6131fBLWOqvLJzQDehesbTSQo7SMxD3ullHknH8EpRzJVNE8LkZnp+p+QWOthf794tqnc8opriR46PSLRLhktuioSFQEnAsRbKxhuLmvUfpGkouJnibyDEMEEwL8DyGnNKBTZS8UnMqgxJ3qMMHC3jpygd+SdIYpKcZNg9yi0ANE8G6Vy78h1hRaNgEjtfMa0U+Ab0P6Kqv/dhsvZ2rQwvUVpd0DiX4bX5yHsnBOaxj206/LXJTxvrSFhmpeskTS9goF/3wiheU72DbHs2K+d2ltqUWOczVCAIFZJbtQAjjfiievq9QrN7vhXBWiv0m5cqK3fK1aYS7iPpPKqVFRMM+KTG9dTpeA== X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5915.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(346002)(376002)(39850400004)(366004)(396003)(136003)(55016002)(9686003)(7696005)(316002)(66946007)(6506007)(186003)(8936002)(53546011)(8676002)(478600001)(2906002)(71200400001)(26005)(83380400001)(5660300002)(64756008)(38100700002)(33656002)(66476007)(86362001)(110136005)(76116006)(66574015)(66556008)(122000001)(66446008)(38070700005)(52536014); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?NExyaXh4V1FWSE9LS2h3SEpDRUttRWY0a2gyREZObm1wc0hqZ3FVRCt4UEEx?= =?utf-8?B?V01UbURTeERBdG0rTHZZMGw0Y0JZcmVDWlBQSXdrTXFVRHBVQ1VpUDIvT29p?= =?utf-8?B?Yjc3OTdIU0trTEw0dnlUZEhubHBJZjlBTnRlRUw2c0UzT3VCc0xrR3pOTFpr?= =?utf-8?B?R2RKaW9WV2l4REhHT29WVVBqU3NlQnROMWZkTzZTSDRETVFFT1ZHRlc3ank1?= =?utf-8?B?RFJsVDRxOXhjamtBa0hDTHZ2MTJGTDlmV2JkUFIyVFlzMmpucE0yL2ZWdnlZ?= =?utf-8?B?dEZBcExKM0xMZjAvakR6VGNaNHFKOTFxbDJjT0gyRmhrSXBQb3daaVJWYWgy?= =?utf-8?B?OS9CVTNXYzh5dldQaS9zL1BXc0hZOWZFU2VYUGljcVpNOE1tbm9EVUYxaUg3?= =?utf-8?B?ak1EY1NaQzBXeGFTNDZnT2Mvb0U1VEM0QVFsb3RIcllNbkxud0grL2NZSHpY?= =?utf-8?B?aTFpNEFkdWlhMGpuZjgzU3pncytUdTdicWx6TEdrNDBDL2hlcCtzbmdGQXJx?= =?utf-8?B?eGxJYkhCQkNENFN6bVI5WEdoRGp1U1dFWGxvVVk2allkSVB0Q0pXQkc0a2kw?= =?utf-8?B?UGg0OFdiZXdEeXB2V0dMQXBVYUJBanV0WGV5NnRyQURHL29UcWtwYjN4SGR3?= =?utf-8?B?QnlvZWpTL0dRWEx1d0lVdjFnM0VzMGVuT1Q2MFZnV0hacnZ1NEtUczhZd1RP?= =?utf-8?B?ZlpHZFNuTXQycGFheTB1YmgvdExZSlNrMFVnYWsrN0dPaGp0SGJ4L3pRc0J4?= =?utf-8?B?Sk9ocFVRTmsyNWZVc2YrQytMUTF6UURDSnNYN2pDTG1kMFByY25OUEVuV1Fl?= =?utf-8?B?dGl0enRudVpaakNFVi9WKzd1VElCeTVteGJNWGk1VktqMTBVMUErSzh0MDVG?= =?utf-8?B?U0hhVGhlVVd5N0dpRnEzV1I1SmtLTjRmREtLOXFnMk9IWExUMUR3ZzFET1JU?= =?utf-8?B?K2MxL2ljSGpIeEFBaTQrYUZkZHBvVmlma1VtS3A3OGVKc3lJSi9WZFJyeGZs?= =?utf-8?B?ek00dXc1eFlaVjdQSGlXckE1SGhhUC9sQWVVZTZYVHdXVmFHUTBYSVM5RlFS?= =?utf-8?B?YmdSdlhLMjJRQUpQMFVvWFR5OFliRzRGQzZzUW1nRE4vbzFwcXJ2WmdvcUVB?= =?utf-8?B?eXVlWmV1dDEyR2pHNTR6VEZnajBXT2gyVUV3b2Fmb0hvbThTQ1ZoTGtzKytQ?= =?utf-8?B?UXk1VlJ5ZTJUazVnS0ZVMDdQSHhvTnVpTmRueUI4WEpObUVIVGFTL3ppVzRO?= =?utf-8?B?YndIVlRsKzZGQWxoYWtCOVNLZHlVa2dSOWV6ekZCU0xkMStZa1JOSkhSR05s?= =?utf-8?B?WEJ1NW1rSTI3Qk9vUzg3L0hSc2x2MjdJQ3pXcDdDTEZtY3ZtN1RnQzVaVi9V?= =?utf-8?B?RlBHOW8rSGw4R2J4WnkxUU1EaWNBdE9PYXJRTkR3WGJRbHZBdWVzek9YOEha?= =?utf-8?B?Umo4WUx0VSsrdituNGtTSW9sM244aW9mWDlSdWZyc0ZXUEV4MTY3a0tZaGtT?= =?utf-8?B?VThPdjFmajVucGhXUkpmdm9Lb3ZZRVRCeUdmMStzS3l1UFZmaTY0Y0Jwb25q?= =?utf-8?B?b3ZnUzFGTzQybHB4TjMxMFlvNEl4bGJnQW5odTZHbTBrU0NEQWRHSFJ4QkNa?= =?utf-8?B?YzJYaEY0NkM2ci9vd1Q4OHRLUTZoYkZaSFJOcDl2MmxLVjc5aEp2cHR4RXdw?= =?utf-8?B?TDJVMnBWMWgzTHY5RXl1MjVzRVFLTWpwV2taSnYzN2MwS0RPWHIyZUF6aVho?= =?utf-8?Q?35KHqgZKNl8wxIageU=3D?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB5514 Original-Authentication-Results: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT057.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: 2513cc5b-364d-4228-d156-08d951c4deb7 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: aNYXRUlLL4gdkW2IrpjpCAPH4oxa08H/0sCPYultGJxo4z8HrNV4DDI8H5OPLQ32yDEKfIlfRD8GafdciEeD8hqT+K3HLhSlNdSOt5Olq2NN8eEYtVk5qlotAW9azrbeSikjhnC/92BlnFzmoN/vZ1eAylvlIkfbnTMF6VBDgKoxQXzYkd+kjc6xQ9iTcH4L26eOkD4jL8k1QaD8GYC/wEaKsFlrGakCgtF8ufS3+aiuYCuuKya+rydkpa6ez45u6CZUINa3jyCUeFQLDU3D99xd4joQSC6EuaKaqhARbD3c8OjRWt7fCjrZB8yHw8CMdx5xG7Tql/uuj6qoM0noybeVNpg3N/eCLRsQCPsT5e30r1I+OsiUQQM8e8/OXlZTymb6UDECZvpIIZ9hF9GGDmgNCzTY65WtoWFpu+EvcLn4/GuXQGtdi/bF91nH+RjJzaCq+6/f+iNK2y+BRcWRAApqii/EcEAohV7m7l+T/M08HSFYtlRcpqBbEZcVFv8p02mVRiEh6/j579zRQjtKMU7bjupQwMvzto9XDTAyb13m2zAUZ4qjpZ91Tjob2TC+1c+EwlQAQ5Pt9b1BxX7Wh9vEamDS+M5vLk1grS4DXnd6mS1KyXTZeBzPDbLuu5z/GspUK6c0QERSFabINS717sp5KG0TCGDIYJoJ3eUo3ofwb97Yg04FowbA0lFyRnwiJA5y+dYLeGojNMyTNRMRgg== X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(396003)(136003)(376002)(39850400004)(346002)(46966006)(36840700001)(70586007)(70206006)(2906002)(336012)(66574015)(36860700001)(83380400001)(47076005)(478600001)(110136005)(5660300002)(316002)(7696005)(53546011)(26005)(6506007)(52536014)(81166007)(86362001)(82310400003)(186003)(8676002)(8936002)(9686003)(356005)(55016002)(33656002)(82740400003); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jul 2021 12:40:39.2351 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b2815440-8852-4bf2-74ff-08d951c4e7c1 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT057.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR08MB7278 Archived-At: Subject: Re: [Iotops] Authorization for IoT devices X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jul 2021 12:40:55 -0000 SGkgTWljaGFlbCwNCg0KUmVtYXJrcyBiZWxvdzoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0t LS0NCkZyb206IE1pY2hhZWwgUmljaGFyZHNvbiA8bWNyK2lldGZAc2FuZGVsbWFuLmNhPg0KU2Vu dDogV2VkbmVzZGF5LCBKdWx5IDI4LCAyMDIxIDM6NTIgQU0NClRvOiBIYW5uZXMgVHNjaG9mZW5p ZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT47IGhycGNAaXJ0Zi5vcmc7IGlvdG9wc0BpZXRm Lm9yZw0KU3ViamVjdDogUmU6IFtJb3RvcHNdIEF1dGhvcml6YXRpb24gZm9yIElvVCBkZXZpY2Vz DQoNCg0KSGFubmVzIFRzY2hvZmVuaWcgPEhhbm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20+IHdyb3Rl Og0KICAgID4gSGF2ZSB5b3UgdHJpZWQgdG8gdXNlIEFDRS1PQXV0aCwgTWljaGFlbD8NCg0KTXkg dW5kZXJzdGFuZGluZyBpcyB0aGF0IGl0IHJlcXVpcmVzIGEgQVMgdG8gZXZhbHVhdGUgdGhlIHJl cXVlc3QgYW5kIHRoZSBnZW5lcmF0ZSBhIHRpY2tldC90b2tlbiBmb3IgdGhlIFJTLg0KDQpbSGFu bmVzXSBZb3UgaGF2ZSB0byBnZXQgdGhlIHBlcm1pc3Npb25zIGZyb20gc29tZXdoZXJlIHNpbmNl IHlvdSBjYW4gaGFyZGx5IGNyZWF0ZSB5b3VyIG93biBwZXJtaXNzaW9ucy4uLg0KDQoxKSBtYW55 IHBlb3BsZSBwZXJjZWl2ZSB0aGUgQVMgYXMgYmVpbmcgdGhlIGNsb3VkIGNvbXBvbmVudCBhbmQg dGhleSBkb24ndA0KICAgd2FudCBhIGNsb3VkIHBhcnQuDQoNCltIYW5uZXNdIFRoZSBBUyBtYXkg YmUgaW4gdGhlIGNsb3VkIGJ1dCBpdCBtYXkgYmUgYW55d2hlcmUgZWxzZSAtLSB3aGF0ZXZlciBp cyBtb3N0IGFwcHJvcHJpYXRlIGluIGEgZ2l2ZW4gZGVwbG95bWVudC4NCg0KMikgYnV0IGluIGFu eSBjYXNlLCBpdCdzIHRoZSBmb3JtIG9mIHRoZSBydWxlcyB3aGljaCB0aGUgQVMgZXZhbHVhdGVz IHRvDQogICBtYWtlIHRoZSBhdXRob3JpemF0aW9uIGRlY2lzaW9uIHRoYXQgSSBjYXJlIGFib3V0 LiAgQUZBSUssIG5laXRoZXINCiAgIE9BVVRIMiBvciBBQ0UtT0FVVEggc3RhbmRhcmRpemVzIHRo YXQgKG9yIGludGVuZHMgdG8pLg0KDQpbSGFubmVzXSBJbiBkZXBsb3ltZW50cyB0b2RheSB0aGUg cnVsZXMgYXJlIG5vdCBzdGFuZGFyZGl6ZWQgYmVjYXVzZSB0aGV5IGFyZSBjb25maWd1cmVkIGJ5 IHRoZSB1c2VyL2FkbWluIGludG8gdGhlIEFTLiBXaGF0IGdldHMgcHVzaGVkIGFyb3VuZCBhcmUg cGVybWlzc2lvbnMsIHdoaWNoIGFyZSBkZWZpbmVkIGZvciBzcGVjaWZpYyBhcHBsaWNhdGlvbiBk b21haW5zLiBUaGVzZSBwZXJtaXNzaW9ucyBhcmUgY2FsbGVkICJzY29wZXMiIGluIHRoZSBPQXV0 aCBsYW5ndWFnZS4gU29tZSBvZiB0aG9zZSBzY29wZXMgaGF2ZSBiZWVuIHN0YW5kYXJkaXplZC4N Cg0KVGhlcmUgaGFzIGFsc28gYmVlbiBhbiBhdHRlbXB0IHRvIHN0YW5kYXJkaXplIG1vcmUgZ2Vu ZXJpYyBBQ0xzLA0Kc2VlIGRyYWZ0LWlldGYtYWNlLWFpZi4NCg0KICAgID4gVGhlIHdvcmsgaW4g dGhlIEFDRSBncm91cCBoYWQgdGhlIGdvYWwgdG8gZGV2ZWxvcCBhbiBhdXRob3JpemF0aW9uDQog ICAgPiBzb2x1dGlvbiBmb3IgSW9UIGRldmljZXMuDQoNCklmIEknbSB3cm9uZyBwbGVhc2UgY29y cmVjdCBtZS4NCkhvdyB3b3VsZCBBQ0UtT0F1dGggaWRlbnRpZnkgdGhlIGxvY2FsIFNoZXJpZmY/ DQoNCltIYW5uZXNdIFRoZSBwdXJwb3NlIG9mIGFuIGF1dGhvcml6YXRpb24gZnJhbWV3b3JrIGlz IG5vdCB0byBpZGVudGlmeSBhIHNwZWNpZmljIHBlcnNvbi4gVGhhdCdzIHRoZSByb2xlIG9mIGFu IGlkZW50aXR5IG1hbmFnZW1lbnQgZnJhbWV3b3JrLiBXaGF0IEFDRS9PQXV0aCB3b3VsZCBiZSBh YmxlIHRvIGRvIGlzIHRvIGdpdmUgdGhlIGxvY2FsIHNoZXJpZmYgYSB0b2tlbiBzbyB0aGF0IHRo ZXkgY2FuIGFjY2VzcyBzcGVjaWZpYyByZXNvdXJjZXMuIFdoYXQgcmVzb3VyY2VzIHRoZXkgY2Fu IGFjY2VzcyBkZXBlbmRzIG9uIHRoZSBjb25maWd1cmVkIGF1dGhvcml6YXRpb24gcG9saWNpZXMu DQoNCklmIHlvdSBhbHNvIHdhbnQgdG8gYWRkIHRoZSBpZGVudGl0eSBtYW5hZ2VtZW50IHBpZWNl IHRvIEFDRS9PQXV0aCAod2hpY2ggcGVvcGxlIGhhdmUgb2J2aW91c2x5IGRvbmUpLCB0aGVuIHlv dSBjYW4gYWRkIE9wZW5JRCBDb25uZWN0IGFuZCwgZm9yIGV4YW1wbGUsIEZJRE8gdG8gdGhlIG1p eC4NCg0KSSBob3BlIHRoaXMgbm93IG1ha2VzIG1vcmUgc2Vuc2UuDQoNCkNpYW8NCkhhbm5lcw0K DQoNCi0tDQpNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitJRVRGQHNhbmRlbG1hbi5jYT4gICAuIG8g TyAoIElQdjYgScO4VCBjb25zdWx0aW5nICkNCiAgICAgICAgICAgU2FuZGVsbWFuIFNvZnR3YXJl IFdvcmtzIEluYywgT3R0YXdhIGFuZCBXb3JsZHdpZGUNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBj b250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlh bCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVk IHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBu b3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3Ig YW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRp dW0uIFRoYW5rIHlvdS4NCg== From nobody Wed Jul 28 11:25:54 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26BD53A1B1D for ; Wed, 28 Jul 2021 11:25:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3MKXx7EcReWG for ; Wed, 28 Jul 2021 11:25:46 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE5923A1B0A for ; Wed, 28 Jul 2021 11:25:46 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 1A439389A0; Wed, 28 Jul 2021 14:29:35 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id D2ZJnZdzEIJ8; Wed, 28 Jul 2021 14:29:29 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id C4EEC3899E; Wed, 28 Jul 2021 14:29:29 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id B2B4E72; Wed, 28 Jul 2021 14:25:39 -0400 (EDT) From: Michael Richardson To: Hannes Tschofenig cc: "hrpc\@irtf.org" , "iotops\@ietf.org" In-Reply-To: References: <18201.1627351357@localhost> <23319.1627437136@localhost> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] Authorization for IoT devices X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jul 2021 18:25:52 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hannes Tschofenig wrote: mcr> 2) but in any case, it's the form of the rules which the AS evalua= tes to mcr> make the authorization decision that I care about. AFAIK, neither mcr> OAUTH2 or ACE-OAUTH standardizes that (or intends to). Hannes> In deployments today the rules are not standardized because they Hannes> are configured by the user/admin into the AS. What gets pushed Hannes> around are permissions, which are defined for specific Hannes> application domains. These permissions are called "scopes" in t= he Hannes> OAuth language. Some of those scopes have been standardized. Thank you for confirming my understanding. I'm looking for a standard for the rules. Why? because auditing, because humans need to understand them, because configuring the rules needs to be something non-experts can do. > There has also been an attempt to standardize more generic ACLs, > see draft-ietf-ace-aif. Not even close, I think. mcr> If I'm wrong please correct me. mcr> How would ACE-OAuth identify the local Sheriff? Hannes> The purpose of an authorization framework is not to identify a Hannes> specific person. That's the role of an identity management Hannes> framework. It's not a specific person, it's a specific role in an particular geography. That's why this problem is non-trivial. > If you also want to add the identity management piece to ACE/OAuth > (which people have obviously done), then you can add OpenID Connect > and, for example, FIDO to the mix. If we can really do this with those specifications, I'd be interested in knowing how, or seeing an example of a system which has done that. I'm actually convinced that we don't need a lot of new work ("new ingredients") to make things go, but I think that we need a clear architecture on combining existing work ("better recipes") =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmEBoSMACgkQgItw+93Q 3WVE9wgAwIslOesHlq8rseXmL1z54p8xqw8kV/ILl4ldTS+gotGzrgSpHKnzjcmH bpXl2vuYsPWvL5R9E3UoW/OOFy4n0ED26Br2ea18zFyCzWQCm3QB6iiUl8Sj+bDH DD03pqEXBWSDnLphA+EgjnnSs0zC4yUKad2goprFykBI29Bdqk9jY60qO4imneN0 i0rpIuvLNSRqUdyBCilKL96WNxLbiKg1lKVcOLEINIIlBYCZ5JbEbruFu2xT6KG5 3YY3g4DROSpzx4Qck+tPMF4M1HE36eeFt9pwx3TkWZwpNRQq4gtKpUYe/8nKjPUk HGLt8n5rYAYC0JTjjOL6r0dgMzGRwg== =1V0k -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 28 11:45:12 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37BCD3A1BA8 for ; Wed, 28 Jul 2021 11:45:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.299 X-Spam-Level: X-Spam-Status: No, score=-1.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001, URIBL_SBL=0.5, URIBL_SBL_A=0.1] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=MapZLrLX; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=MapZLrLX Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ae1ol6KBJ_7v for ; Wed, 28 Jul 2021 11:45:05 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10057.outbound.protection.outlook.com [40.107.1.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D05563A1BA5 for ; Wed, 28 Jul 2021 11:45:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EZYAj/FibObPlxbek8W9xY++xGh32n+ZnEAOPyQuXhU=; b=MapZLrLXneNjDXBZoWiNdVI8KR24VtiDV+lkpCvxTjgew1vfOwBxbNE7eD+peWZEztRbOL0i4bMQROUqvIjtuDIOrvqQNvuz46wpPoxXDF11ZOPTfLKIpjD1wBoDK7O6mb96fHoFDXl95ig6pO2yp8PRcovOW1i43zTDsEBBr6o= Received: from AM6P192CA0084.EURP192.PROD.OUTLOOK.COM (2603:10a6:209:8d::25) by DB9PR08MB6860.eurprd08.prod.outlook.com (2603:10a6:10:2ae::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18; Wed, 28 Jul 2021 18:45:00 +0000 Received: from AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:8d:cafe::bf) by AM6P192CA0084.outlook.office365.com (2603:10a6:209:8d::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18 via Frontend Transport; Wed, 28 Jul 2021 18:45:00 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT062.mail.protection.outlook.com (10.152.17.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.24 via Frontend Transport; Wed, 28 Jul 2021 18:45:00 +0000 Received: ("Tessian outbound 31e6e3649d31:v100"); Wed, 28 Jul 2021 18:44:59 +0000 X-CR-MTA-TID: 64aa7808 Received: from 3c4e7882d960.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 32272C9F-D64B-4F24-B9A8-784A8BBA80B2.1; Wed, 28 Jul 2021 18:44:53 +0000 Received: from EUR04-DB3-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 3c4e7882d960.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 28 Jul 2021 18:44:53 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BcJbxJuT2PEBpGP1h9JJ05ZT1viPsIlT0MK4P+JEzV91zn+BdrBGnjc9DkQFcDMG3A1KvZtHQMo1GDvFtr2Ea/X2yAPJOosTDvLfYIJ3SloBMbsskHuejgjnEbu82KbeQpf54liPm8G8ycuF3W5JrXZQpjJX4eNesGveVnZ3pfz6L4RYAHKDZPG+CCTExkVKwDAEUww9J6g+EEygCYjtVADyW1Cs6MQ66xet+PTkoIG5Hkk/5WYKO7y/wSESD9VPmVejHzAIuLdcPhVzRxZ9Vk7QQHvP4AyvjnocF8zx6jk9em69qkzTSKvrWlvvwJMwDfJYNGlNKrcElbR2BGPjJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EZYAj/FibObPlxbek8W9xY++xGh32n+ZnEAOPyQuXhU=; b=YjXi8+WJ3uQf81aVu3J3kr5voereg55O4UCyD1DsNgLQjkxbBnp6HTCpCRsLO51M/wukjllzs3jJ+8BvfpO39rMbrjuk+m63G1TShiRuyrVW8AT2VO8WO18WHLbY3RdfoYRFhND+jPsJK2+wMH7pKBrmCR2JTq3NB9Sv/hVWMTM0PffXSgf8t8p/JBkPuOFL2eBOJq417pApaXpdeChSeQGAkbMnXvwALJ4Xui/uGisZKjT6B+nRRqPtfdmeUME1TRLSBxrIDnS+owJTlb5I5YMXQqirQMqmzSkkeqQiivIGOjnCFGB7IyDr8VvOtgaZ6vrhIx7z3goAN9FUNzW2ng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EZYAj/FibObPlxbek8W9xY++xGh32n+ZnEAOPyQuXhU=; b=MapZLrLXneNjDXBZoWiNdVI8KR24VtiDV+lkpCvxTjgew1vfOwBxbNE7eD+peWZEztRbOL0i4bMQROUqvIjtuDIOrvqQNvuz46wpPoxXDF11ZOPTfLKIpjD1wBoDK7O6mb96fHoFDXl95ig6pO2yp8PRcovOW1i43zTDsEBBr6o= Received: from DBBPR08MB5915.eurprd08.prod.outlook.com (2603:10a6:10:20d::17) by DB9PR08MB6745.eurprd08.prod.outlook.com (2603:10a6:10:2a2::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18; Wed, 28 Jul 2021 18:44:51 +0000 Received: from DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518]) by DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::55c7:8f34:351:9518%3]) with mapi id 15.20.4373.018; Wed, 28 Jul 2021 18:44:51 +0000 From: Hannes Tschofenig To: Michael Richardson CC: "hrpc@irtf.org" , "iotops@ietf.org" Thread-Topic: [Iotops] Authorization for IoT devices Thread-Index: AQHXgouVFWMKuox4kUWxdOEjkHQAe6tWlvdQgAEKVACAALMi8IAAYmqAgAAAYOA= Date: Wed, 28 Jul 2021 18:44:50 +0000 Message-ID: References: <18201.1627351357@localhost> <23319.1627437136@localhost> <2926.1627496739@localhost> In-Reply-To: <2926.1627496739@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: BB454F9660F4374993C26D4DB2B9E5E7.0 x-checkrecipientchecked: true Authentication-Results-Original: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com; x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 891b5b1c-02ef-4953-ebe2-08d951f7ce0a x-ms-traffictypediagnostic: DB9PR08MB6745:|DB9PR08MB6860: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: Wk32rZJ8wykCSiS6rnDa341VFj/JryzKjgfLNL6YHVHFTBosgw93WqJg4if3npqKLNlJwurPkhK8yXExSOIJIYviLCMdNUTryRxG6gTiLsebN3Q6lQpknJoKYLPoYyxRWcr7MweMiJRg13anb2bb1hPQvr6NW/2MZ9mtnqvaPGzRh0SgL0FVKfUCe3uGaNrTJeDTjvU8Yj7dHxj0MgUHTqt2WF3TEDX56d9FddXn4qUEGeXwu6hviGMDS2RjC74ZKf0t/jigTO3UC8jCVVa2oKqlfdkvBcKoW2WZXyAKJzv6eolgEouxKi5AU/0wJhU3JxxRzJKw/saLi1N9dHvC5rMj0xkqIrA3nxi8jEff5sULmd0DV22baErUayh0brkOK3vr+8af6edOzjbqi0neDDceGBrP40LNazmcAjlhrARyw7/XWJ/J5y9ZeswpbDturaq1w6Dmi5D7oRUwYEn2KHC5gCsZXe+0Ehl7APne5uFF4ty2EGyfjSzE6FixFBB6lM3nT225x+mdJV9pQUPhx5/Lzrt0IgvkfCoRLIkdT94B0ReYKPQ0yREeI0cLBpM3exbyUB5S0lSVGOvO4TkdpE7A3lYRWWyUqGhG/v4dEVRvV7ros/byGZ6QYcNYYIOWe7JCQznamquag8FZiETrsl+bMa9Z5ufqRaD7IhpkJfZ3At6dw5Zl/4Z+TX2wSGEX9/zkd9uajINQZZXDX266ZIR9M+Rg4lcu+PpG8GYSjyiO27fFNJYPT0ElhhCucdIUlCufSbKRrLO06eQvsZ5klo3U881fO+J6xQZxBv7iEmmd81rMHGHIHQDCEZId8PXdqSjmldG0M/FQi5cCH+/ru9F3NnSioTSTDzBc+tiKstU= X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5915.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(396003)(39850400004)(376002)(366004)(346002)(66446008)(66946007)(64756008)(66476007)(66556008)(38100700002)(26005)(8936002)(122000001)(966005)(66574015)(4326008)(33656002)(9686003)(55016002)(38070700005)(76116006)(5660300002)(52536014)(54906003)(186003)(83380400001)(8676002)(71200400001)(316002)(478600001)(6506007)(16799955002)(2906002)(7696005)(86362001)(15398625002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?NFRxeUpPWlRBZ0NDWENBYWxDck5uSjNHcUw4KytVZHk1Vkg0d1FzUmJacEVC?= =?utf-8?B?NFh2YmlTSEJiRHNTeXMrWk43eGdoTHJ2K25leWpmM1BOYWNPWVVvZGwrREU2?= =?utf-8?B?ZkNtNFRUZDN1L1BQWlhmbHdLTEwyaUgya2plbmpFc0NSRXdlaGpvc2NxY2xq?= =?utf-8?B?QUFIcXduZUZBL0ZSUVpuNC9jZnM1V2YvWEhBTnlRUEEyZnZheUJnaDVhMlll?= =?utf-8?B?OC94ZUFnRUNTOCtZRE5EZVphSUpHNW5rSXZ5am5LQjlDV21NSnpnWjNRQnl2?= =?utf-8?B?YnZlRlNCY20yaFhTWHZjSkJIZlRHS1RvdVN4RkcycUxpSmlLTlVNNXhJeHRw?= =?utf-8?B?NWg3NWo5MUx4NlhrRTY1andPTDhYNCt3bkNMU1Q0NEx0RzRzNHRFbkltUGhZ?= =?utf-8?B?U2dTM2JvdjhkbWVVbUpxdHJoWjAvRlJPdDVRcVYrbXQ3TXp3V2JpMTZvN2c0?= =?utf-8?B?REE0QVlORUdPVmo0bVltUEZ2N2k4Q1RVUHVEMU0rSFZKWHI3Q0pXVDh1ZFU0?= =?utf-8?B?TmRJSnEwVVRzNUlhRUdqT2NNTjloekR2R2ZTV2hyRWUvbDBDdHVnclc2WC85?= =?utf-8?B?REdjVXlkTmE5S1RnUXlyUEY1QTUxaUQrTm1iUEtST2hja1ZEVk5LUmVtVDJC?= =?utf-8?B?aU9uenUxaWFmWjQ1OXhWMVoyZjZMc2kzSlpmWlhEa1NUVDQ2TkZxdDBOZ2NE?= =?utf-8?B?MWh4Y2Nrb01hR0VXelF1alBDKzc5dWZ2ZFBsT2F2OGZxaWNkTCtVczI1L2pl?= =?utf-8?B?ZE5ETlltdE5XU2EydjF6ekEzQnVzcnpEMGsrbldSZnJ2MVNTZ08rb3QzL3R5?= =?utf-8?B?NXRlTTRTNFZZbERtWFBVY0ViSmk4VittSlBYNmVxL2txWUpGV3RSakR4TXJH?= =?utf-8?B?SDlJM1VqSmlNdk4yWHFaaExYMGthVm40NkN5QzczTDNrT3hEZ3d2RTNQNENV?= =?utf-8?B?eE1waUlPS1lFeHoxalE1UEljcGsrd1FVVGFIWCtVRjU2a01tb1czaDZIRlh6?= =?utf-8?B?WTBualJzb2hhTnQ5aDk4Zmp5dnBSTFUySHM4TzcyZTFlVWNTaUpkaDYzNHBV?= =?utf-8?B?L3VzWHdDMExDeEZDanVYR2w0S20vZERhYkxIY2dDNzd0TzZpaElqYVI3cm4x?= =?utf-8?B?NWdVRFJOYThVRzM3d2JpQVdwaGo5UjlZUUFlZC94bFhid0tVZytNZEd4bE1o?= =?utf-8?B?ZE1ud1U2eTljU3JKSGZLZ0pGdkF2QTQvaU0rWGVzMGhMYUdFQ1pNazgzaEZ5?= =?utf-8?B?WDV1TDE5Z3V3WDUxKzdPbGZQT0hhdzg2YStZQ0JwMWU3MnBOWlVlYlk1em41?= =?utf-8?B?a1Boc3ErVG93TmJvVElZRnNNcjUxMnZJb3VtVENKeGtZT0E0SSswZXNmY21w?= =?utf-8?B?K2Z0djRXOTlTRWZYMmNoazZibG84QVNQZjRNODA3ME8xN3NnOXRPMkJIbFkr?= =?utf-8?B?amkyazlWQU9ueW5VbHNwdXpleEUwYkdRempla2pobXQwN0JPcDdGRkpRYVN2?= =?utf-8?B?S0liSzJEakdYc2lQajFJc2krditCdUtMTmdBYUcrOXNOU2tiekFKeENNQzdX?= =?utf-8?B?QXd0cWVTTG5TbXh1VStxN0s3eU9mZ3hFZVFQejNaL3JvajVhTFNwN2FDcGFs?= =?utf-8?B?UDVyKzVYSjJ0cTl0R3VhaCtkTFZJS1IrUVlRNU45Vi84SGhFYmhla0lnZHlz?= =?utf-8?B?WXJWY1dVdndlVnBRSVkwUDl1bjBpMjRPRG9mOG5NV2FZNUU0enNMdU03bnJn?= =?utf-8?Q?9KFVCWnMRPjdaBnPlXIbvNleh247dnavTsNw7hR?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB6745 Original-Authentication-Results: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: a4157c22-8cfb-4f98-7bd9-08d951f7c86d X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: vhbu6DpP80M03TZNBAM41iqpNGwuML2WZSbQhAIE7hXOzwB665HBtU/q724whdiyd/+kxZRqG/dofPKUTeWSWC6jV4oIbHeIpN9b4ulLDefM3YVX8KRi0GG4O798kYT4TopX6BxgQZGN0iGDq5EeO7bYSUQO4ZV16kAUHolyJTrzNbtnBeV/TbZuLLG4/sxxzQbLInIntQ72C3+7eHXXRo4JZVywTVw2Wy9dZuTsOBqs0K5mkotJYLE03I5zbB5bmP4UMKBLyi7aLoia1dtGG/bHz9CuA0TA/iURVwX+8mqyzXLDENKrnJw6G/ak7QwHA/KqA4nJb0eISuN6YCSXdBqLMp0LvHhtaQSE+5Dw/TNrDKX7IgQc9MKJlrNY3kc0LDY2MKRAimAoT8y6UjgT74ewl3fOU+1sm7UrMGCXGNan6x/7hrNDhCVaVGlxvAvzJA9GUR/jaEJfuGD4X0j96+D4/RxNXTPBS4vA6Q2WrOeZZI6qDtt1Nz4tVsrMyNaUgGt1CKEgTZI+KviphQuF8VtbdgU+u/0ZJQQP8+DcIrnPRjWXFWqQBCaettTW6ZTYipG5z7MSr4OzAq0UG+r3QQmlIgg5Qtm8y4qEMdRywaFE4b9iEUUCfk5D5QVBpGHQJAA27WNdJ0wm2nukOepaHuElMD7NNO69KBKZUJCXtJJHNs5dER/GYYKVRS1gmxeQWHVWRPMJqJjzP0UINd5IJkce+w0ooAoR8k8XMZcuvx5Qt8YDFA6MbNgl3vPfvwCSY3a28E60oDI/DznfOvKyAxrFs0+7ST03CVaHv5zvcqo9ETysbVsSQ8F7BvEroisD2w3+b5dd4pETHX0WPm4K1KG4RoZneHKwB2arwutGQwc= X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(136003)(346002)(39850400004)(376002)(396003)(36840700001)(46966006)(70206006)(81166007)(186003)(52536014)(4326008)(336012)(966005)(478600001)(55016002)(7696005)(6862004)(9686003)(2906002)(356005)(86362001)(54906003)(5660300002)(6506007)(26005)(33656002)(8936002)(16799955002)(66574015)(47076005)(316002)(36860700001)(70586007)(82310400003)(8676002)(82740400003)(83380400001)(15398625002); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jul 2021 18:45:00.4650 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 891b5b1c-02ef-4953-ebe2-08d951f7ce0a X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB6860 Archived-At: Subject: Re: [Iotops] Authorization for IoT devices X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jul 2021 18:45:10 -0000 SGkgTWljaGFlbCwNCg0KfnNuaXAhDQogICAgSGFubmVzPiBPQXV0aDogU29tZSBvZiB0aG9zZSBz Y29wZXMgaGF2ZSBiZWVuIHN0YW5kYXJkaXplZC4NCg0KTWljaGFlbDogVGhhbmsgeW91IGZvciBj b25maXJtaW5nIG15IHVuZGVyc3RhbmRpbmcuDQpNaWNoYWVsOiBJJ20gbG9va2luZyBmb3IgYSBz dGFuZGFyZCBmb3IgdGhlIHJ1bGVzLg0KTWljaGFlbDogV2h5PyBiZWNhdXNlIGF1ZGl0aW5nLCBi ZWNhdXNlIGh1bWFucyBuZWVkIHRvIHVuZGVyc3RhbmQgdGhlbSwgYmVjYXVzZSBjb25maWd1cmlu ZyB0aGUgcnVsZXMgbmVlZHMgdG8gYmUgc29tZXRoaW5nIG5vbi1leHBlcnRzIGNhbiBkby4NCg0K SGVyZSBhcmUgc29tZSBleGFtcGxlcyBvbiB3aGF0IGhhcyBiZWVuIHN0YW5kYXJkaXplZDoNCg0K U2VjdGlvbiA1LjQgb2YgdGhlIE9wZW5JRCBDb25uZWN0IENvcmUgc3BlY2lmaWNhdGlvbiBkZWZp bmVzIGEgZmV3IHNjb3BlIHZhbHVlcyByZWxhdGVkIHRvIGlkZW50aXR5IG1hbmFnZW1lbnQ6DQpo dHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb3BlbmlkLWNvbm5lY3QtY29yZS0xXzAuaHRtbA0KDQpU aGUgaGVhbHRoY2FyZSBzcGVjaWZpY2F0aW9uIGluIHRoZSBPSURGIGRlZmluZXMgc2NvcGVzIGlu IHRoZWlyICJIZWFsdGggUmVsYXRpb25zaGlwIFRydXN0IChIRUFSVCkiIHNwZWNpZmljYXRpb246 DQpodHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb3BlbmlkLWhlYXJ0LWZoaXItb2F1dGgyLTFfMC5o dG1sDQoNCk1vcmUgc3BlY3Mgb2YgdGhlIE9JREYgZnJvbSBvdGhlciBhcHBsaWNhdGlvbiBkb21h aW5zIGNhbiBiZSBmb3VuZCBoZXJlOg0KaHR0cHM6Ly9vcGVuaWQubmV0L2RldmVsb3BlcnMvc3Bl Y3MvDQoNCkluIHRoZSBPQXV0aCB3b3JraW5nIGdyb3VwIHdlIGFsc28gaGF2ZSBzb21lIHdvcmsg b24gc2NvcGVzIGFzIHBhcnQgb2YgdGhlIHdvcmsgb24gcmljaCBhdXRob3JpemF0aW9uIHJlcXVl c3RzLiBTZWUgQXBwZW5kaXggQSBmb3IgZXhhbXBsZXM6DQpodHRwczovL2RhdGF0cmFja2VyLmll dGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtb2F1dGgtcmFyLTA1DQoNCg0KICAgID4gVGhlcmUg aGFzIGFsc28gYmVlbiBhbiBhdHRlbXB0IHRvIHN0YW5kYXJkaXplIG1vcmUgZ2VuZXJpYyBBQ0xz LA0KICAgID4gc2VlIGRyYWZ0LWlldGYtYWNlLWFpZi4NCg0KTWljaGFlbDogTm90IGV2ZW4gY2xv c2UsIEkgdGhpbmsuDQoNClRoaXMgaXMgd29yayBpbiBwcm9ncmVzczsgc28geW91IGNhbiBzdWdn ZXN0IGNoYW5nZXMuDQpZb3UgY291bGQgcHVzaCBpdCBhbGwgdGhlIHdheSB0byB0dXJuIGl0IGlu dG8gWEFDTUw6DQpodHRwczovL3d3dy5vYXNpcy1vcGVuLm9yZy9jb21taXR0ZWVzL3RjX2hvbWUu cGhwP3dnX2FiYnJldj14YWNtbA0KDQoNCiAgICBtY3I+IElmIEknbSB3cm9uZyBwbGVhc2UgY29y cmVjdCBtZS4NCiAgICBtY3I+IEhvdyB3b3VsZCBBQ0UtT0F1dGggaWRlbnRpZnkgdGhlIGxvY2Fs IFNoZXJpZmY/DQoNCiAgICBIYW5uZXM+IFRoZSBwdXJwb3NlIG9mIGFuIGF1dGhvcml6YXRpb24g ZnJhbWV3b3JrIGlzIG5vdCB0byBpZGVudGlmeSBhDQogICAgSGFubmVzPiBzcGVjaWZpYyBwZXJz b24uIFRoYXQncyB0aGUgcm9sZSBvZiBhbiBpZGVudGl0eSBtYW5hZ2VtZW50DQogICAgSGFubmVz PiBmcmFtZXdvcmsuDQoNCk1pY2hhZWw6IEl0J3Mgbm90IGEgc3BlY2lmaWMgcGVyc29uLCBpdCdz IGEgc3BlY2lmaWMgcm9sZSBpbiBhbiBwYXJ0aWN1bGFyIGdlb2dyYXBoeS4NCk1pY2hhZWw6IFRo YXQncyB3aHkgdGhpcyBwcm9ibGVtIGlzIG5vbi10cml2aWFsLg0KDQpUaGlzIGlzIHdoeSB5b3Ug d2lsbCBoYXZlIHRvIHdvcmsgb3V0IHN0YW5kYXJkcyBmb3IgY2VydGFpbiBhcHBsaWNhdGlvbiBk b21haW5zIHNpbmNlIG90aGVyd2lzZSB0aGlzIHdpbGwgZ2V0IHNvIGNvbXBsZXggdGhhdCBub2Jv ZHkgaXMgZ29pbmcgdG8gdXNlIGl0Lg0KDQogICAgPiBJZiB5b3UgYWxzbyB3YW50IHRvIGFkZCB0 aGUgaWRlbnRpdHkgbWFuYWdlbWVudCBwaWVjZSB0byBBQ0UvT0F1dGgNCiAgICA+ICh3aGljaCBw ZW9wbGUgaGF2ZSBvYnZpb3VzbHkgZG9uZSksIHRoZW4geW91IGNhbiBhZGQgT3BlbklEIENvbm5l Y3QNCiAgICA+IGFuZCwgZm9yIGV4YW1wbGUsIEZJRE8gdG8gdGhlIG1peC4NCg0KTWljaGFlbDog SWYgd2UgY2FuIHJlYWxseSBkbyB0aGlzIHdpdGggdGhvc2Ugc3BlY2lmaWNhdGlvbnMsIEknZCBi ZSBpbnRlcmVzdGVkIGluIGtub3dpbmcgaG93LCBvciBzZWVpbmcgYW4gZXhhbXBsZSBvZiBhIHN5 c3RlbSB3aGljaCBoYXMgZG9uZSB0aGF0Lg0KDQpGSURPIGhhcyBhIHdoaXRlcGFwZXIgdGhhdCB0 YWxrcyBhYm91dCB0aGUgaW50ZXJhY3Rpb24gYmV0d2VlbiBGSURPIGFuZCBpZGVudGl0eSBtYW5h Z2VtZW50IHRlY2hub2xvZ3ksIHNlZQ0KaHR0cHM6Ly9tZWRpYS5maWRvYWxsaWFuY2Uub3JnL3dw LWNvbnRlbnQvdXBsb2Fkcy9FbnRlcnByaXNlX0Fkb3B0aW9uX0Jlc3RfUHJhY3RpY2VzX0ZlZGVy YXRpb25fRklET19BbGxpYW5jZS5wZGYNCmh0dHBzOi8vZmlkb2FsbGlhbmNlLm9yZy9maWRvLWFu ZC1mZWRlcmF0aW9uLXByb3RvY29scy10ZWNoLW5vdGUvDQoNCkZXSVcgd2UsIGFzIHBhcnQgb2Yg UGVsaW9uLCBldmVuIGhhdmUgYSBwcm9kdWN0IGRvaW5nIHRoaXMgZm9yIElvVCB1c2UgY2FzZXMu IEkgYmxvZ2dlZCBhYm91dCBpdCBhIHdoaWxlIGFnbzoNCmh0dHBzOi8vY29tbXVuaXR5LmFybS5j b20vZGV2ZWxvcGVyL3Jlc2VhcmNoL2IvYXJ0aWNsZXMvcG9zdHMvbWJlZC1zZWN1cmUtZGV2aWNl LWFjY2Vzcy1lbmhhbmNpbmctaW90LWRldmljZS1tYW5hZ2VtZW50LXdpdGgtdXNlci1hdXRoZW50 aWNhdGlvbi1hbmQtZmluZS1ncmFpbmVkLWFjY2Vzcy1jb250cm9sDQpIZXJlIGlzIHNvbWUgbW9y ZSBpbmZvIGFib3V0IHRoZSBwcm9kdWN0IGNhbGxlZCAiU2VjdXJlIERldmljZSBBY2Nlc3MiOg0K aHR0cHM6Ly9kZXZlbG9wZXIucGVsaW9uLmNvbS9kb2NzL2RldmljZS1tYW5hZ2VtZW50L3Y0LjEv c2RhL2luZGV4Lmh0bWwNCg0KTWljaGFlbDogSSdtIGFjdHVhbGx5IGNvbnZpbmNlZCB0aGF0IHdl IGRvbid0IG5lZWQgYSBsb3Qgb2YgbmV3IHdvcmsgKCJuZXcgaW5ncmVkaWVudHMiKSB0byBtYWtl IHRoaW5ncyBnbywgYnV0IEkgdGhpbmsgdGhhdCB3ZSBuZWVkIGEgY2xlYXIgYXJjaGl0ZWN0dXJl IG9uIGNvbWJpbmluZyBleGlzdGluZyB3b3JrICgiYmV0dGVyIHJlY2lwZXMiKQ0KDQpUaGF0IHdv dWxkIG9idmlvdXNseSBiZSBnb29kLg0KDQpDaWFvDQpIYW5uZXMNCg0KLS0NCk1pY2hhZWwgUmlj aGFyZHNvbiA8bWNyK0lFVEZAc2FuZGVsbWFuLmNhPiAgIC4gbyBPICggSVB2NiBJw7hUIGNvbnN1 bHRpbmcgKQ0KICAgICAgICAgICBTYW5kZWxtYW4gU29mdHdhcmUgV29ya3MgSW5jLCBPdHRhd2Eg YW5kIFdvcmxkd2lkZQ0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1h aWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBw cml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ug bm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29u dGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3Rv cmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0K From nobody Wed Jul 28 14:35:11 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 785BD3A21CF for ; Wed, 28 Jul 2021 14:35:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9x5ufhDjBISG for ; Wed, 28 Jul 2021 14:35:05 -0700 (PDT) Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFDDC3A21CE for ; Wed, 28 Jul 2021 14:35:05 -0700 (PDT) Received: by mail-pj1-x1033.google.com with SMTP id a4-20020a17090aa504b0290176a0d2b67aso12244031pjq.2 for ; Wed, 28 Jul 2021 14:35:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:reply-to:user-agent:mime-version; bh=auLB/ksP9hbtX1sbenI8FvYWaOJM3doTabF5If4r1HM=; b=oT2OYZ8+bQTsAjU82e9fF0KV0URMMxt3l7tVulil/E+wdAh14xO8Mps1uXL9azPLDC Hw/cq8GstI/yWgMeLq5DYM6u4p7JeMWlTaNEgsA201OAOj+nJFDsNtFzlwsZueu2WWUZ kgIZqlmOrATUie7IA3XrWbRrSSwRt6fdsDD3fKl4bt6CYCHQ2KJFbgWN9osJumRYe7Z7 3f8or4cXqs99OYEft0AMZe1TxXsA83Qc6lD8pooyagCpTBt4j3EFrbdDgQCs1kA3wjE+ MBPIQErYQ7MDkH1Gxket8s84pmOviGZxto/MYTjn8pwOI82HhCoKa5dvdenG6LWU8WTx eFAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:reply-to :user-agent:mime-version; bh=auLB/ksP9hbtX1sbenI8FvYWaOJM3doTabF5If4r1HM=; b=Ju+AaLgSfEDjvp3myVkyNRJnFOBs0CjWM0B+ICWf3avU+Z9TOk0McBkHwkuJbjVKAI T6aKcErFghmsL+QY6NIfQqN3O0y99LBJqlLvSZVfqNT1ptgVWw0Taa3nnuDjiV1LJw2x aThIuxqkflP/IIFNmJaT6gHCqfwzOrc7kr4R15JUxYTGbJk25xXLG6l5fsGfKZ7vpqM5 XYfSaQCMXC/jSNGYfgR+/RxrzeUYQyP2gBj8YfxLdRBA/Jr10oVTaYf1dYfmPh1A8C8H ehZxbEXORtCx3fFakOPSiD3CKP1jBbWd8wH2xmiPAKHN95qTZFEIYZCe9m6EMd2mhEZD 8o2g== X-Gm-Message-State: AOAM532lA8i29iFhCusEdHnahu10lQi9gk4AKgSBYVmwq1rh0uHUaPrM zKOZuS7/P5aUI4b+cR4jDxjHkoI//Nethg== X-Google-Smtp-Source: ABdhPJyUHc1nEzNVkRySHjEWtwobwAJ2l9snuZaZ1w3BMpdpNztRXbSp2ZhDy/YNU/P0/ZdRSjcMjw== X-Received: by 2002:a17:902:a609:b029:12b:858e:d116 with SMTP id u9-20020a170902a609b029012b858ed116mr1492184plq.25.1627508104974; Wed, 28 Jul 2021 14:35:04 -0700 (PDT) Received: from [192.168.1.54] (c-73-202-182-183.hsd1.ca.comcast.net. [73.202.182.183]) by smtp.gmail.com with ESMTPSA id p5sm962361pfn.46.2021.07.28.14.35.04 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Jul 2021 14:35:04 -0700 (PDT) From: "Kiran Makhijani" To: "iotops@ietf.org" Date: Wed, 28 Jul 2021 21:35:03 +0000 Message-Id: Reply-To: "Kiran Makhijani" User-Agent: eM_Client/8.2.1473.0 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="------=_MBB0857DE8-BA96-4E87-9587-C9C344773C03" Archived-At: Subject: [Iotops] Industry network control scenarios X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jul 2021 21:35:10 -0000 --------=_MBB0857DE8-BA96-4E87-9587-C9C344773C03 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Hi All, Thanks for positive feedback on the industrial-control networks=20 requirements. Based on the comments, a restructuring of the document=20 will be done - possibly details of dealing with diversity of protocols,=20 support for automation & virtualization scenarios, (+?). These items=20 clearly reside on IETF side of things. Work on framework was also suggested. I think its a good idea especially=20 to elaborate different floor-devices to cloud connectivity. Other comments on cross-SDO interest, the point is well-taken. I hope we=20 continue to piece together problem stmt and find stakeholders to comment=20 on it in parallel. Datatracker still has 00 version, but the document is live at GitHub - kiranmak/draft-km-industry-net=20 We invite IOTOPS to help contribute and/or review. Thanks, Kiran --------=_MBB0857DE8-BA96-4E87-9587-C9C344773C03 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi All,=C2=A0
Thanks for positive feedback on the industrial-cont= rol networks requirements. Based on the comments, a restructuring of the do= cument will be done - possibly details of dealing with diversity of protoco= ls, support for automation & virtualization scenarios,=C2=A0 (+?). Thes= e items clearly=C2=A0reside on IETF side of things.=C2=A0
Work on framework was also suggested. I think its a good idea e= specially to elaborate different floor-devices to cloud connectivity.
Other comments on cross-SDO interest, the point is well-taken.= I hope we continue to piece together problem stmt and find stakeholders to= comment on it in parallel.=C2=A0=C2=A0
Datatracker s= till has 00 version, but the document is live at=C2=A0

We invite IOTOPS to help co= ntribute and/or review.=C2=A0
Thanks,
Kiran
--------=_MBB0857DE8-BA96-4E87-9587-C9C344773C03-- From nobody Thu Jul 29 04:20:31 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 774793A1EDB for ; Thu, 29 Jul 2021 04:20:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.552 X-Spam-Level: X-Spam-Status: No, score=-2.552 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.452, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9YQkLrykxbma for ; Thu, 29 Jul 2021 04:20:23 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60071.outbound.protection.outlook.com [40.107.6.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CF6F3A1ED9 for ; Thu, 29 Jul 2021 04:20:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QTjzFCG1pOXB3kAVCVKH/XZ+xmSim7iN4v7VU4lTwJopSzIm6S4FVHLBE4wNGcW9Dle0PMEkGu1XL5BXb+/komCsSXvgnsEC7SdzA19mwfENhtLctaDxBcC1gEmnhyXGnLzIbR1MS3TwSzzgPayiFhbMHd9kYuDnOBK2xYVpgTpiNIJwnT6bnuiznu9gHfjWYYRjUl3jvUyEGpquYsgPG6cD8KX0Xo+hiq20hZ+iKYEESeqNxZG7c5LT2xjy8sGx92IzM7hRsobmYCaXhVTT++dY3bxSUi9MV6YFyxZFXphutHBc/yR6QDT49IwP1fHnm+DVUmzjPEu0uLVqQrFdrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Hyup/Zymt2st7aFILDt/ARbjiRW1h8e0NISLxa8xJs=; b=iEt4cMt5Q3EPHaLtn6J4KYrgS2iprXNNjaqbaAfFL89eanuWTMycjvQworUBNMrk9NyCnB8qvWdAJM9KtnSX7G4F1GY+eRPLt5UESPSzmsvO/4fEYpF1zhlWItI9sjQ6oR+9+ejsgcJ4YI1R3lP6RzjPdNit4hbUsaAW31rzzQEpVPcWybmplprm9K7/Y4OCgLSmngP+eaAWDtRAWzm+be39U+253BKG7gRNE4P+lU0MlWwgK2rYGwtwB9HDQm6ZmjwGnCm+KBVLPpxcl4WDlzYsyJhiYeJiSVUBsdPL0WOhtB3vZBzylPDTZcfsBKB5eL901K2NZne7NkMMvBl9fQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Hyup/Zymt2st7aFILDt/ARbjiRW1h8e0NISLxa8xJs=; b=MXCtWNvT5CY6mClh0zvd4+vjxFD/fZ1RqTVbndUyQylvoE1B431NAxvj+fu2zDXwBucfF17rmxCjnaP69B+2ygKTic45o34s7IprKp/JbcVMbIZSLXqPDhEXqsXAUOChKH0a/dqcTtCwCSSx8sUQUEOcN9ZbXctztwf7f1Yg+GI= Received: from HE1PR07MB4441.eurprd07.prod.outlook.com (2603:10a6:7:9f::27) by HE1PR0701MB2459.eurprd07.prod.outlook.com (2603:10a6:3:72::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.10; Thu, 29 Jul 2021 11:20:21 +0000 Received: from HE1PR07MB4441.eurprd07.prod.outlook.com ([fe80::8cb8:b3b2:b265:d65f]) by HE1PR07MB4441.eurprd07.prod.outlook.com ([fe80::8cb8:b3b2:b265:d65f%5]) with mapi id 15.20.4373.020; Thu, 29 Jul 2021 11:20:20 +0000 From: Christer Holmberg To: "iotops@ietf.org" Thread-Topic: OPC UA FLC and TLS Thread-Index: AdeEa2bLnohQow63Tf29sTDrh4zlBA== Date: Thu, 29 Jul 2021 11:20:20 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=ericsson.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8efce5db-9a95-40ca-1323-08d95282d9f4 x-ms-traffictypediagnostic: HE1PR0701MB2459: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4714; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: IGQvsuKaOpfcfxKH9+WoYouJuYNZtF5iIo7JEvvmrLaoAMQdoq1L4Q+jW5BSDmA9v4Gx5PlufnPMZQbelsLu5IZWnAjqx+l/I3DkfBdVfnuRiQDu4OtcbEjp7IfPZuURBZW/qvp4ZxpqX6By/2Kkp4ufRo+J0uJfzyvdVQKOo6H9ilbS0MRDaUtKwUJupIZAzzU00iB67MARFXAimmTQINnyzVUAGznZlD1MUX9loUN7Y1yvMX6fFwZfkMFWrfHRdrySOteuPhb9T9pMC4XGr1FbsxG90n+JyDP3wLLqAwwYGdOhMBiV4kI2n3hixRgyOZuRAAL/fO9SGF6uyszuXq+q2A7XchJhylcPZTHZxCKOXTTfnPVPx7vnF0omif5sXz5MdWfjijOQC5PMwZDEoImDMcDx1YSmOSQfury5OF6ZmL9j8ys4dRYw46FgaTfdTUb8v3FPjBelOFquhSLwLcN+jKYrWZa4DtsI5ol41O8s7sTMptd7rT5hgNqIFUax19TUjttc3Bb9M03usisjom1sOn2kHhf+CrptAm1H/qUMByLOYOw/NYqjYOFpvaKdZcjJMuRliPrZQ9TWXX/34m3CIrNgJI2a1UEhPRd/3UjeRhRIHa6BRp0+zy8YJtYSKiU13A5tpgc6UeDqvMlaz6374pPXtBpore/2GNqpo2Psq34LZbeoFR6rg8jrzOZFaFgwdJy9/pMGwExFNzw2Hg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB4441.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(8676002)(71200400001)(33656002)(316002)(64756008)(66476007)(38070700005)(66556008)(66446008)(7696005)(558084003)(52536014)(9686003)(6506007)(86362001)(186003)(76116006)(122000001)(5660300002)(44832011)(6916009)(66946007)(508600001)(2906002)(26005)(55016002)(8936002)(38100700002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?x7srNTTrZ1cmpcddDygx/jhytTGp7JcjIueex3V5W1DY9jMxGiAi6xFHwo3a?= =?us-ascii?Q?MUKu7YLwRuYkH0blVdVtJhaVkS2rKPqgxbcd6SD1NPtCY5Ve87DnCnpbs3h6?= =?us-ascii?Q?7T7+QKciQhScRWNKrVkOrceQLFcWI6n9vk3F0kbnTHi+wGZNBQ9l1uir0WiB?= =?us-ascii?Q?wReH2djEXNymcWYHWx0//VH6TjF0WXE1S4mEHtrcB/g5DarRlo07Heteuk4W?= =?us-ascii?Q?7L2KpBmQoz2Uf4T459uy9fyer898sUV08m5eLZdl2xoJ9N/mVwiYg0uBQafg?= =?us-ascii?Q?u9hOiroTmr+XGhRSSx4SXMdMIRHTQUeNaQcYJkZPHzdUDkmOWGy25HNnaLQx?= =?us-ascii?Q?IY+vCOVm/eg6lx0JCrMHIby1BO2IsaFoku7eE9dmA6e5edJIL0P7OCqOjrZG?= =?us-ascii?Q?L1iMZdLGoOn8DTl+TbZOOGXe0tWDQbL0ZJYK4wO4nDVfmxTS/HGy2e/lzmZv?= =?us-ascii?Q?0ElDZsvaEjf0CWvnFnGU6C6kmxBGIyixCD72LPx05/gbVs/k5nL3K3jSTfjQ?= =?us-ascii?Q?dA0ZEn2suenKh/AlS2SPfiia51ff4QpH3yErDAXb73O3VuPHbqGenarKwB0U?= =?us-ascii?Q?bxO/5kOFyS8r/+8cOjaHvp7VMxg3fEaxXSOLc6oWRdfP2nW9W5yaiT1DjKFf?= =?us-ascii?Q?FfPJlT3zp6yKe513RkCUwXQBtyDaQ8byCubVTSVsbxsrqbjDelr6wg+aF8aA?= =?us-ascii?Q?itEFjpeGYijONZ59pH28dcHtfPmsbyTmPid0QiWSnJdtMT3LdYh5EJSSHsCl?= =?us-ascii?Q?hRptXje0NNeOyokSoDrTESq8LK1rGXXEh7zKgKEBd980ZFwbGaJSsBoyfm/R?= =?us-ascii?Q?ePF0Ajni9m3bF7kz1LBzdg0CHFAROo68QVffAhPA6RlDRAvT7pVW75nTTVn8?= =?us-ascii?Q?bn6JcleP3lTOLdpjWE3dEm5gRKoTH2WEodxufgIVElDxpluYZ5fwTzoGlpjN?= =?us-ascii?Q?5VgSNFvZmb4Be0C0goo9zwMfbq8BS/RiZzSEYhvwo7re0raIJXOeQUE4n9q+?= =?us-ascii?Q?IlmFGZeXI6PyY0zUOAFXMK2rO4wpJsWhG++6uJblDsXA8H385m/TZVPaURPP?= =?us-ascii?Q?UdIsMwmyZUI+nZLe8MFJMpyK918Uo9BarZQt+jwSux19RkH02PK4DMlYfXsB?= =?us-ascii?Q?DFQ6Cyj9nJ0NxwcHNruqIW4Oyll64QC8oYhvLLq/tkZlU0mRW6yAfKSUy6jL?= =?us-ascii?Q?ibs4sBFaAjYHc5TyVr43avF/ZGgDpWD7aY8ng0mGuQXSxprbLkCLPWZBU8Ei?= =?us-ascii?Q?6v6KHMB+AvhCnNNQAKsPun+oCGx29AEigyxWhsHNmLL1qzfYiFEOT37AETTL?= =?us-ascii?Q?yzzGRqGVRTq38vq9g+Xl1Gwr?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_HE1PR07MB4441973D24954117AFB6804693EB9HE1PR07MB4441eurp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB4441.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8efce5db-9a95-40ca-1323-08d95282d9f4 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2021 11:20:20.3824 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Uj87VvDAOVoX3qe86f1jshkR2NyaWUNPMnHenrCWE2gXG5BCMeZLdTHIzWH1N79TGfMVzSFCKcygkNN+yhZ/6OSIsmps25GFXGMYIRjJ5d4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2459 Archived-At: Subject: [Iotops] OPC UA FLC and TLS X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Jul 2021 11:20:30 -0000 --_000_HE1PR07MB4441973D24954117AFB6804693EB9HE1PR07MB4441eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, When I watched the YouTube video from them iotops session someone claimed t= hat OPC UA FLC "re-invented" TLS. What was meant by that? Someone also mentioned "IP over Modbus", but I assume that was a joke? Regards, Christer --_000_HE1PR07MB4441973D24954117AFB6804693EB9HE1PR07MB4441eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

When I watched the YouTube vide= o from them iotops session someone claimed that OPC UA FLC “re-invent= ed” TLS. What was meant by that?

 

Someone also mentioned “I= P over Modbus”, but I assume that was a joke?

 

Regards,

 

Christer

--_000_HE1PR07MB4441973D24954117AFB6804693EB9HE1PR07MB4441eurp_-- From nobody Thu Jul 29 05:09:51 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C45383A2088; Thu, 29 Jul 2021 05:09:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.89 X-Spam-Level: X-Spam-Status: No, score=-0.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_ALL=0.8, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, SPF_PASS=-0.001, T_SPF_HELO_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=lear.ch Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a_-FBFIKZv-R; Thu, 29 Jul 2021 05:09:42 -0700 (PDT) Received: from upstairs.ofcourseimright.com (upstairs.ofcourseimright.com [185.32.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A7783A2084; Thu, 29 Jul 2021 05:09:41 -0700 (PDT) Received: from [IPv6:2001:420:c0c0:1011::6] ([IPv6:2001:420:c0c0:1011:0:0:0:6]) (authenticated bits=0) by upstairs.ofcourseimright.com (8.15.2/8.15.2/Debian-18) with ESMTPSA id 16TC9cWl089900 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Thu, 29 Jul 2021 14:09:39 +0200 Authentication-Results: upstairs.ofcourseimright.com; dmarc=none (p=none dis=none) header.from=lear.ch DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=lear.ch; s=upstairs; t=1627560579; bh=VCDC2vPPBOpUVgDkGJRMSodLll+uz5qC6rCipjRJKVk=; h=To:References:From:Subject:Date:In-Reply-To:From; b=dnLDbV5NEBDre1upQ1oKh9BZgpWs7oBCJS0pn2sxSsTrWKSruDJ95JIJH3y4sfGpr MFTO/tjfD9f23il+kyhKPAgctUHuhRBlsVZolUiiZFmY32cL6wIZpXvn7jMVpmfj5e NZuWRpLAZqgS6qJ2YYOq4P3fk+v5yNzf5dtPtIL0= To: Christer Holmberg , "iotops@ietf.org" References: From: Eliot Lear Message-ID: <1dd35348-c00c-ba43-1876-dced553218a4@lear.ch> Date: Thu, 29 Jul 2021 14:09:36 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.12.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="9xFCcLpaRfMcjpwqaBe1UHoFVLfQenoVb" Archived-At: Subject: Re: [Iotops] OPC UA FLC and TLS X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Jul 2021 12:09:49 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --9xFCcLpaRfMcjpwqaBe1UHoFVLfQenoVb Content-Type: multipart/mixed; boundary="ZNOicEv1dTEhGyPFD3HrBQ8hP6JlESCoH"; protected-headers="v1" From: Eliot Lear To: Christer Holmberg , "iotops@ietf.org" Message-ID: <1dd35348-c00c-ba43-1876-dced553218a4@lear.ch> Subject: Re: [Iotops] OPC UA FLC and TLS References: In-Reply-To: --ZNOicEv1dTEhGyPFD3HrBQ8hP6JlESCoH Content-Type: multipart/alternative; boundary="------------B324C8993F9DBE0B1CCFF2EB" Content-Language: en-US This is a multi-part message in MIME format. --------------B324C8993F9DBE0B1CCFF2EB Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Christer, On 29.07.21 13:20, Christer Holmberg wrote: > > When I watched the YouTube video from them iotops session someone=20 > claimed that OPC UA FLC =E2=80=9Cre-invented=E2=80=9D TLS. What was mea= nt by that? > That was my mistake.=C2=A0 Other organizations (not OPC UA) have reinvent= ed=20 TLS, but OPC UA is just out of date, so far as I can tell.[1] Eliot [1] https://reference.opcfoundation.org/Core/docs/Part2/ --------------B324C8993F9DBE0B1CCFF2EB Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Christer,

On 29.07.21 13:20, Christer Holmberg wrote:

When I watched the YouT= ube video from them iotops session someone claimed that OPC UA FLC =E2=80=9Cre-invented=E2=80=9D TLS. What was meant by that?

That was my mistake.=C2=A0 Other organizations (not OPC UA) have reinvented TLS, but OPC UA is just out of date, so far as I can tell.[1]

Eliot

[1] https://reference.opcfoundation.org/Co= re/docs/Part2/


--------------B324C8993F9DBE0B1CCFF2EB-- --ZNOicEv1dTEhGyPFD3HrBQ8hP6JlESCoH-- --9xFCcLpaRfMcjpwqaBe1UHoFVLfQenoVb Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAmECmoAFAwAAAAAACgkQh7ZrRtnSejO9 DggAyc2igY/lNduP2Lpg5+6CjS5b4WeOVU7v1b0c+0pK9x4rjHxfYX50CFURtUpq/nGgMKBOqAcB B+riCOhbAL8L5mI6DKPo79NXC6yj426Niu4OnICHSe/o7poI4Kc3rkOg5g7E9uZ2ArWu9In0PWhW x21fTjVbeQZSaEVuNT1jpZ7Cpp+lOnTVarzyMNzzqAkbODgpHTRabhjQtdYaYNcKkfGw/BpZp1+3 Jz/e5c5+bkWb2ZEnSmBVVuugnsJ8ZujMCud1FdwQwYfD3wqIwESIdlbU+Kft8y8sJx29MqM+oWHT 8WvE2K3eRZPBTUS3T56Ua94rRJFZno7+XcfyMRH3jQ== =h36N -----END PGP SIGNATURE----- --9xFCcLpaRfMcjpwqaBe1UHoFVLfQenoVb-- From nobody Thu Jul 29 11:39:09 2021 Return-Path: X-Original-To: iotops@ietfa.amsl.com Delivered-To: iotops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EFD13A154F for ; Thu, 29 Jul 2021 11:39:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sBVDtSbOUk0j for ; Thu, 29 Jul 2021 11:39:02 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E13493A154D for ; Thu, 29 Jul 2021 11:39:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id DCB43389D7; Thu, 29 Jul 2021 14:42:52 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 10Sqtfg7gXw9; Thu, 29 Jul 2021 14:42:49 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id D716B389D1; Thu, 29 Jul 2021 14:42:49 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 0AC11FC; Thu, 29 Jul 2021 14:38:56 -0400 (EDT) From: Michael Richardson To: Eliot Lear , Christer Holmberg , "iotops\@ietf.org" In-Reply-To: <1dd35348-c00c-ba43-1876-dced553218a4@lear.ch> References: <1dd35348-c00c-ba43-1876-dced553218a4@lear.ch> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Iotops] OPC UA FLC and TLS X-BeenThere: iotops@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IOT Operations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Jul 2021 18:39:07 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Eliot Lear wrote: > On 29.07.21 13:20, Christer Holmberg wrote: >> >> When I watched the YouTube video from them iotops session someone cl= aimed >> that OPC UA FLC =E2=80=9Cre-invented=E2=80=9D TLS. What was meant by= that? >> > That was my mistake.=C2=A0 Other organizations (not OPC UA) have rein= vented TLS, > but OPC UA is just out of date, so far as I can tell.[1] My understanding is that OPC UA has a legacy DCOM based system that uses RSA signature for authentication, but is not related to TLS/SSL/etc. But that they use TLS and DTLS (1.3 even) in the latest specifications. =2D- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmEC9b8ACgkQgItw+93Q 3WUTUwf9HTzKAi8MQ735YvlxM05duEzmgeujtBvpuVwBaQL6iIjhfxkasbTKZREE I8HO4HShajDLjTbqNgHeafm0sWCTsWWWWhln9AjkKMywaJF68RZzcsYbtgXXqHHk T4s5BeVm52Zm5RJM482n7i007luVhVmQJUnGe9JPXGZpQsMcQAFkwTwaRgur+54C kesax5/JM6DyrHrEIOe1MkNYs5jkNO5hfhrw93bFHmuUhyCTBUe+cX1xjxee/tYg mo1V3rdYaD8h4EL6Jxc9rFOi5XPRGNQwJWZjcZ/9/qHikKsslIzEPbT4ADoZw1I6 y0EwSRMsjokhQfICbglG7Ueit2mPjg== =W/hy -----END PGP SIGNATURE----- --=-=-=--