Subject: [Secauth] What is your opinion?

From: "Hosnieh Rafiee" <[email-masked]>
Date: Fri, 26 Sep 2014 21:16:16 +0200

Proposed charter and the working items of secauth
------------------------------------------------------------------------
There are various authentication and authorization mechanisms in use today.
These mechanisms might only support particular devices, for instance, only
available for constrained devices or it might only focuses on nodes with
rich resources (CPU, memory, etc.) without the possibility for them to be
used for constrained devices. Therefore, there are different types of
heterogeneous protocols available and use over the internet that cannot
authenticate or work together. This is why, there is usually a need that
both devices support the same mechanism. Thereby, Having a mechanism to
interoperate between all available mechanisms and enable different
mechanisms to work together for a robust authentication and authorization,
without the need for the nodes to support individual protocols is demanding.
In other word, using a simple, light approach (like a language) that can be
supported by all current devices so that it provides the possibility for two
devices that uses two different authentication and authorization protocols
to exchange their secure parameters in a secure manner. Therefore, one of
the purpose of secauth is to eliminate security gaps during authentication
and authorization and provide a simple solution that can be supported by
different nodes with different resources and play a role of interoperate
protocol. 

In addition, providing trust during the establishment of the communication
is usually out of the scope of the existing security protocols. This is why
there is usually a big gap that demands some to many manual configurations
to provide a node with a secure authentication/authorization. Automating the
establishment of this communication, providing user/device authentication
and authorization, minimizing the need of human interaction and interoperate
between other protocols to provide a robust secure authentication and
authorization between two heterogeneous protocols is what this group aim to
address.  

Furthermore, secauth aims to remove the need of CAs or
installation/configuration of any infrastructure for the purpose of
authentication and authorization. This allows the wide use of this protocol
over the networks. 

The tasks of this group includes:
------------------------------------
1) Produce problem statement, requirements and use cases 
2) Identify the design and architecture for providing first point of trust
and reduce the security gap as much as possible and consider confidentiality
for this solution
3) Identify the existing protocols that needs this interoperation 
4) Identify the light cryptographic approaches that can be used for
authentication and authorization purposes

Any thought? Please share your comments or your ideas.

Thank you,
Best,
Hosnieh

---

From: Hosnieh Rafiee <[email-masked]>
Date: Mon, 29 Sep 2014 11:54:27 +0000

Folks,

I asked ADs for a side meeting (room request) in upcoming IETF. I still do not know the time but as soon as I know this, I will let you know. 

I still did not received any opinion on the charter. I welcome your inputs so that it can be as clear as possible.

Thanks,
Best,
Hosnieh
> These mechanisms might only support particular devices, for instance,
> only available for constrained devices or it might only focuses on
> nodes with rich resources (CPU, memory, etc.) without the possibility
> for them to be used for constrained devices. Therefore, there are
> different types of heterogeneous protocols available and use over the
> internet that cannot authenticate or work together. This is why, there
> is usually a need that both devices support the same mechanism. Thereby,
> Having a mechanism to interoperate between all available mechanisms and
> enable different mechanisms to work together for a robust
> authentication and authorization, without the need for the nodes to
> support individual protocols is demanding.
> In other word, using a simple, light approach (like a language) that
> can be supported by all current devices so that it provides the
> possibility for two devices that uses two different authentication and
> authorization protocols to exchange their secure parameters in a secure
> manner. Therefore, one of the purpose of secauth is to eliminate
> security gaps during authentication and authorization and provide a
> simple solution that can be supported by different nodes with different
> resources and play a role of interoperate protocol.
> 
> In addition, providing trust during the establishment of the
> communication is usually out of the scope of the existing security
> protocols. This is why there is usually a big gap that demands some to
> many manual configurations to provide a node with a secure
> authentication/authorization. Automating the establishment of this
> communication, providing user/device authentication and authorization,
> minimizing the need of human interaction and interoperate between other
> protocols to provide a robust secure authentication and authorization
> between two heterogeneous protocols is what this group aim to address.
> 
> authentication and authorization. This allows the wide use of this
> protocol over the networks.
> 
> 
> 2) Identify the design and architecture for providing first point of
> trust and reduce the security gap as much as possible and consider
> confidentiality for this solution